| name | paystack-browser-webhooks |
| description | Use when an agent considers Paystack webhook handling while using @alexasomba/paystack-browser; explains why webhook verification belongs on a server and not in browser code. |
| license | MIT |
| compatibility | Modern browsers and bundlers; package tooling/SSR builds require Node.js >=22.0.0; ESM package; public-key frontend runtime only. |
Paystack Browser Webhook Boundary
Do not handle or verify Paystack webhooks in browser code. Webhooks are server-to-server events and require your Paystack secret key.
Correct architecture
- Browser starts or resumes a payment using public-key-safe flows.
- Backend verifies transaction state using a server SDK.
- Backend receives Paystack webhooks on a server route.
- Backend verifies the raw webhook body with the Paystack secret key.
Do not do this in browser code
- Do not expose
sk_test_* or sk_live_*.
- Do not verify
x-paystack-signature in frontend JavaScript.
- Do not fulfill orders based only on browser callbacks.
- Do not trust client-submitted webhook payloads.
Recommended path
Use @alexasomba/paystack-node or @alexasomba/paystack-axios on the backend for webhook verification, then update durable application state from the verified event.
