Using Payment Webhooks to Fulfill Orders Automatically (Card and Crypto)

If you sell online, you don't want to check a dashboard every time someone pays. A webhook is an HTTP request the payment platform sends to your server when something happens — for example, payment confirmed. Your store receives it and marks the order paid, sends the download link or creates the shipment.

Events that matter

• Payment detected — the transfer was seen; useful to show "processing".
• Payment confirmed — final; this is the one that should trigger fulfillment.
• Payment failed / expired — release reserved stock, notify the customer.

Verify every webhook

Anyone can send an HTTP request to your endpoint. Vulta signs each webhook with an HMAC using your webhook secret. Before acting:

1. Read the raw request body exactly as received.
2. Compute the HMAC with your secret.
3. Compare it to the signature header using a constant-time comparison.
4. Reject anything that doesn't match.

Make your handler idempotent

Webhooks can be delivered more than once (retries after a timeout, manual replays). Store the payment ID and ignore events you have already processed. Fulfilling the same order twice is worse than fulfilling it a few seconds late.

Respond fast

Return a 2xx response quickly and do slow work (emails, shipping labels) in a background job. A slow response can be treated as a failure and retried.

Failures and replays

If your server is down, deliveries fail. Vulta keeps failed deliveries in a dead-letter list in Settings → Webhooks, where you can inspect and replay them once your server is back.

Matching payments to orders

Create one payment request per order and store its ID with the order — or pass your own order ID as the external reference. When the webhook arrives, look the order up by that ID.

Availability

Webhooks are included in Vulta Max ($49/month), along with the embeddable checkout, custom checkout domain and no Vulta branding. Developer details are in the docs.

Frequently asked questions

Which plan includes webhooks?

Max ($49/month) and Business.

How do I find my webhook secret?

In Settings → Webhooks after you add your endpoint URL. Keep it server-side only.

What if my endpoint is down for an hour?

Failed deliveries are kept in the dead-letter list, where you can inspect and replay them once your server is back.

Should I trust the redirect after payment instead?

No. The customer may close the tab before redirecting. Always fulfill on the confirmed webhook, not on a page visit.