Handle Paystack Webhooks in Spring Boot

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.ignoringRequestMatchers("/webhooks/**"))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/webhooks/**").permitAll()
                .anyRequest().authenticated()
            );
        return http.build();
    }
}

@RestController
@RequestMapping("/webhooks")
public class WebhookController {
    @Value("${paystack.secret-key}")
    private String secretKey;

    @Autowired
    private PaystackService paystackService;

    @PostMapping("/paystack")
    public ResponseEntity<String> handleWebhook(
            @RequestBody String body,
            @RequestHeader("X-Paystack-Signature") String signature) {

        if (!verifySignature(body, signature)) {
            return ResponseEntity.badRequest().body("Invalid signature");
        }

        // Parse and process
        ObjectMapper mapper = new ObjectMapper();
        try {
            JsonNode event = mapper.readTree(body);
            String eventType = event.get("event").asText();
            JsonNode data = event.get("data");

            processEvent(eventType, data);
        } catch (Exception e) {
            // Log error but still return 200
        }

        return ResponseEntity.ok("OK");
    }

    private boolean verifySignature(String body, String signature) {
        try {
            Mac mac = Mac.getInstance("HmacSHA512");
            SecretKeySpec keySpec = new SecretKeySpec(secretKey.getBytes(), "HmacSHA512");
            mac.init(keySpec);
            byte[] hash = mac.doFinal(body.getBytes());

            StringBuilder hexString = new StringBuilder();
            for (byte b : hash) {
                String hex = Integer.toHexString(0xff & b);
                if (hex.length() == 1) hexString.append('0');
                hexString.append(hex);
            }

            return MessageDigest.isEqual(
                hexString.toString().getBytes(),
                signature.getBytes()
            );
        } catch (Exception e) {
            return false;
        }
    }

    private void processEvent(String eventType, JsonNode data) {
        if ("charge.success".equals(eventType)) {
            String reference = data.get("reference").asText();
            paystackService.verifyAndFulfill(reference);
        }
    }
}

@Test
public void testValidWebhook() throws Exception {
    String payload = "{\"event\":\"charge.success\",\"data\":{\"reference\":\"test\"}}";
    Mac mac = Mac.getInstance("HmacSHA512");
    SecretKeySpec keySpec = new SecretKeySpec("sk_test_xxx".getBytes(), "HmacSHA512");
    mac.init(keySpec);
    String signature = Hex.encodeHexString(mac.doFinal(payload.getBytes()));

    mockMvc.perform(post("/webhooks/paystack")
        .content(payload)
        .contentType(MediaType.APPLICATION_JSON)
        .header("X-Paystack-Signature", signature))
        .andExpect(status().isOk());
}

This guide is part of the Paystack integration guides by language and framework series.

Sign up for the McTaba newsletter