📬 Webhook Notifications
Receive final transaction status even if the customer does not return.
In addition to redirecting the user to your return_url after authentication, BoxCharge also sends a webhook notification to your backend. This ensures you receive the final transaction status even if the user doesn't return to your website.
Webhook payload
Plain text (encryption_method=none)
{
"bill_currency": "EUR",
"transID": "100203250509173720",
"mop": "Visa",
"ccno": "411111XXXXXX1111",
"reference": "22PostDEVJAVA250415",
"order_status": "25",
"webhook_notify_time": "2025-05-09 17:37:45.000522",
"bill_amt": "130.0",
"status": "Test Approved",
"response": "3DS test card approved"
}When encryption_method=aes256, the webhook delivers an encrypted data parameter. Decrypt with your private_key and public_key using AES-256-CBC.
Best practices
- Always verify webhook authenticity before updating order state
- Respond with HTTP 2xx within 5 seconds
- Implement idempotent handlers — retries may occur
- Use webhooks as source of truth, not return_url alone