Webhook - Payment Method Registered #

1. Webhook Overview #

Purpose #

Note: A registered URL is required to receive Webhooks. (Contact: ebp-server@lge.com)

Details #

2. Authentication #

All Webhook requests sent by the EBP system include the following headers for integrity verification. The store must validate these values to ensure the request is legitimate.

Signature Generation and Verification Rules #

The store should generate its own signature by combining the received Webhook body data and the timestamp header value, then compare it with the received x-webhook-signature value.

1. Input Message Composition: x-webhook-signature-timestamp header value + "." + original Request Body (JSON String)
2. Hashing: Hash the composed message using the HMAC-SHA256 algorithm and the Webhook Secret Key issued by EBP.
3. Encoding: Convert the hashing result into a Hex string (Hexadecimal).
4. Verification: Check if the generated Hex string matches the value in the x-webhook-signature header.

Verification Example (Java) #

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.HexFormat;

public class WebhookVerifier {
    private static final String HMAC_SHA256 = "HmacSHA256";

    /**
     * Webhook signature verification method
     *
     * @param secretKey     Webhook Secret Key issued by EBP
     * @param timestamp     Value of x-webhook-signature-timestamp header
     * @param requestBody   Received HTTP Request Body (JSON string)
     * @param receivedSig   Value of x-webhook-signature header
     * @return Whether the verification was successful
     */
    public boolean verifySignature(String secretKey, String timestamp, String requestBody, String receivedSig) {
        if (timestamp == null || receivedSig == null || secretKey == null || secretKey.isEmpty()) {
            return false;
        }

        try {
            String inputMessage = timestamp + "." + requestBody;
            
            Mac mac = Mac.getInstance(HMAC_SHA256);
            SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), HMAC_SHA256);
            mac.init(secretKeySpec);
            
            byte[] hashBytes = mac.doFinal(inputMessage.getBytes(StandardCharsets.UTF_8));
            String generatedSig = HexFormat.of().formatHex(hashBytes);
            
            return generatedSig.equalsIgnoreCase(receivedSig);
        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
            // log.error("Failed to verify EBP webhook signature", e);
            return false;
        }
    }
}

[!IMPORTANT]
The Webhook Secret Key must be issued through EBP. For inquiries, please contact ebp-server@lge.com. If signature verification fails, the request should be considered untrusted and ignored.

3. Data Schema #

3.1. Payload Data Schema #

3.2. Payload Example #

{
  "eventType": "PAYMENT_METHOD_CREATED",
  "eventTime": "2026-01-27T04:40:00Z",
  "data": {
    "userNo": "TH1741850000100",
    "paymentMethodId": "3e104ef7b98f4123948a8c248d0da4c5",
    "status": "ACTIVE",
    "paymentMethod": "CARD",
    "resultCode": "0",
    "resultMessage": "SUCCESS",
    "pgProvider": "WORLDPAY"
  }
}