Handle Paystack Webhooks in Flask

# app.py
import hmac
import hashlib
import json
import os
from flask import Flask, request

app = Flask(__name__)
PAYSTACK_SECRET = os.environ.get('PAYSTACK_SECRET_KEY')

@app.route('/webhooks/paystack', methods=['POST'])
def paystack_webhook():
    signature = request.headers.get('X-Paystack-Signature', '')

    if not signature:
        return 'Missing signature', 400

    computed_hash = hmac.new(
        PAYSTACK_SECRET.encode('utf-8'),
        msg=request.data,
        digestmod=hashlib.sha512,
    ).hexdigest()

    if not hmac.compare_digest(computed_hash, signature):
        return 'Invalid signature', 400

    event = json.loads(request.data)
    process_event(event)

    return '', 200

request.data in Flask gives you the raw bytes of the request body. This is exactly what you need for HMAC computation. No special middleware or configuration is required.

def process_event(event):
    event_type = event.get('event')
    data = event.get('data', {})

    if event_type == 'charge.success':
        handle_successful_payment(data)
    elif event_type == 'charge.failed':
        print('Payment failed: ' + str(data.get('reference')))
    elif event_type == 'subscription.create':
        handle_new_subscription(data)
    elif event_type == 'invoice.payment_failed':
        handle_failed_renewal(data)

def handle_successful_payment(data):
    from helpers import verify_and_fulfill
    reference = data.get('reference')
    if reference:
        verify_and_fulfill(reference, db)

# test_webhook.py
import hmac
import hashlib
import json

def test_valid_webhook(client):
    payload = json.dumps({
        'event': 'charge.success',
        'data': {'reference': 'test_123', 'amount': 500000},
    })

    signature = hmac.new(
        b'sk_test_xxx',
        msg=payload.encode(),
        digestmod=hashlib.sha512,
    ).hexdigest()

    response = client.post(
        '/webhooks/paystack',
        data=payload,
        content_type='application/json',
        headers={'X-Paystack-Signature': signature},
    )

    assert response.status_code == 200

npx ngrok http 5000

Set the ngrok HTTPS URL as your webhook URL in the Paystack dashboard: https://abc123.ngrok.io/webhooks/paystack

1. HTTPS required. Use gunicorn behind nginx with SSL.
2. Respond quickly. Return 200 within seconds. Use Celery for heavy processing.
3. Idempotent handlers. Check if the event was already processed.
4. Log everything. Store webhook events in a database for debugging.

This guide is part of the Paystack integration guides by language and framework series.

Sign up for the McTaba newsletter