| name | ethoca-webhooks |
| description | Receive and verify Ethoca (Mastercard) Alerts webhooks. Use when setting up an Ethoca Alerts Push API receiver, securing the endpoint (mTLS, with optional onboarding-agreed HTTP Basic Auth; no HMAC signature), or handling fraud and dispute alert notifications.
|
| license | MIT |
| metadata | {"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"} |
Ethoca Webhooks
Ethoca (a Mastercard company) delivers Alerts — early fraud and dispute
notifications from issuers — to merchants. The Alerts Push API HTTPS-POSTs
JSON to an endpoint you register with the Ethoca Customer Delivery Team.
When to Use This Skill
- How do I receive Ethoca Alerts webhooks (Push API)?
- How do I secure an Ethoca webhook endpoint without a signature header?
- How do I handle Ethoca fraud and dispute alerts?
- Why is there no
X-Ethoca-Signature / HMAC header to verify?
- How does Ethoca mTLS (MSSL) delivery work?
Verification (core)
There is NO per-message HMAC/signature header on Ethoca Push API alerts. Do
not look for X-Ethoca-Signature or a Standard Webhooks header — none exists.
Trust is established primarily by the transport:
- Transport — mutual TLS (MSSL) — the definitive check. Ethoca presents a
client certificate; your server must trust the CA and require a
client cert. This is enforced at your TLS terminator / load balancer, not in
app code, and is the actual mechanism that authenticates the delivery.
