paymob-webhooks

name	paymob-webhooks
description	Receive and verify Paymob webhook callbacks (transaction callbacks). Use when setting up Paymob webhook handlers, debugging HMAC-SHA512 signature verification, or handling payment transaction states like success, refund, void, and auth/capture from the Transaction Processed Callback.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Paymob Webhooks

When to Use This Skill

• How do I receive Paymob webhooks (transaction callbacks)?
• How do I verify a Paymob HMAC signature?
• Why is my Paymob HMAC verification failing?
• How do I tell if a Paymob transaction succeeded, was refunded, or voided?
• Understanding the difference between the Transaction Processed Callback (POST) and Transaction Response Callback (GET)

Verification (core)

Paymob does not use Standard Webhooks, and it does not sign the raw body. Instead it computes HMAC-SHA512 over a fixed, ordered concatenation of 20 specific fields (no separators), hex-encodes it, and sends the result as the hmac query parameter on the callback URL (?hmac=<hex>). Use the HMAC secret from your Paymob dashboard.

The 20 fields, in this exact order, are read from the transaction object (obj in the POST payload): , , , , , , , , , , , , , , , , , , , .