Webhooks

Verify OasisPay Events

OasisPay sends `X-OasisPay-Signature`, `X-OasisPay-Timestamp`, and `X-OasisPay-Event`. Verify `HMAC_SHA256(timestamp + "." + rawBody, webhookSecret)`.

// Node.js / JavaScript
import crypto from "crypto";

function verifyWebhook(rawBody, headers, secret) {
  const timestamp = headers["x-oasispay-timestamp"];
  const signature = headers["x-oasispay-signature"];
  const expected = crypto
    .createHmac("sha256", secret)
    .update(timestamp + "." + rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

Events

payment.success, payment.failed, virtual_account.credit, transaction.created, settlement.completed, payout.successful, payout.failed

Fixing 403 Webhook Delivery Errors

Webhook Delivery Behind Cloudflare

If your website uses Cloudflare, its firewall, WAF, bot checks, or rate limits can block OasisPay server-to-server webhook requests. The payment can still be successful, but your site may not credit the customer if your webhook endpoint returns HTTP 403.

OasisPay webhook source IPs

167.233.33.130

2a01:4f8:1c18:4c3b::1

Create a Cloudflare custom rule that matches only your OasisPay webhook endpoint and sets the action to Skip. Skip WAF/custom rules, rate limiting, bot fight mode, browser integrity, security checks, and managed rules for that endpoint only.

Best permanent option

Create a DNS-only webhook subdomain that points directly to your server, for example `webhook.merchantdomain.com`, and use a dedicated path like `https://webhook.merchantdomain.com/your-oasispay-webhook-path`. This removes Cloudflare from the webhook delivery path while leaving your main website protected.

(ip.src eq 167.233.33.130 or ip.src eq 2a01:4f8:1c18:4c3b::1)
and http.host eq "merchantdomain.com"
and http.request.uri.path eq "/your-oasispay-webhook-path"
and http.request.method eq "POST"

How to verify

Use OasisPay webhook test or replay, confirm HTTP 200 in Recent Attempts, and check Cloudflare Security Events for the OasisPay IP.

Do not do this

Do not disable Cloudflare globally, bypass all POST requests, whitelist every IP, or credit users from an email receipt alone.