Webhooks Notification

We will send real time event data to your application endpoint and will send it to your app as Event JSON Payload with POST requests. E.g when a token is generated then you will receive token.status.authorized event and it will create data as Token Object, when charge succeeded, you will receive charge.succeeded event and it will create data as Charge Object.

Webhook Security

• We implement a security layer for our webhook request and utilize Event ID as an idempotency key to prevent the occurrence of duplicate webhook requests.

• Any webhook request exceeding 15 minutes should be rejected by the Partner to mitigate potential security risks.

• Coda will provide IP for whitelisting for webhook request.

Request Header	Description
X-Request-Time	This header contains a timestamp in UTC format and it indicates the time when a webhook request was sent.
X-Signature	This header involves the HMAC 512 Algorithm
X-Version	This header contains a version Number

Signature Generation

Below code snippet is a sample code for generating signatures. The code sample is using Apache Commons Codec Library, which provides an implementation of algorithms including HMAC. The generation process is tightly linked with request time and request body.

Java

public String generateSignature(@Nonull String requestTime, @Nonull String requestBody, @Nonull String signingSecret) {
	// Construct signature message
String message = String.format("%s.%s", requestTime, requestBody);

// using commons-codec:commons-codec:1.16.0 library
return new HmacUtils("HmacSHA512", signingSecret).hmacHex(message);
}

Coda IP Address

• QA: 18.136.53.162

• Prod: 18.142.81.115, 18.139.237.164, 52.76.210.89