solidgate-webhooks

name	solidgate-webhooks
description	Receive and verify Solidgate webhooks. Use when setting up Solidgate webhook handlers, debugging signature verification with the merchant and signature headers, or handling payment events like card_gate.order.updated, card_gate.chargeback.received, subscription.updated.v2, or alt_gate.order.updated.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Solidgate Webhooks

When to Use This Skill

• How do I receive Solidgate webhooks?
• How do I verify Solidgate webhook signatures?
• How do I handle card_gate.order.updated or subscription.updated.v2 events?
• Why is my Solidgate webhook signature verification failing?
• Setting up a Solidgate payment or subscription webhook handler

Verification (core)

Solidgate does not use Standard Webhooks. Each request carries two headers:

• merchant — your webhook public key (prefix wh_pk_)
• signature — the HMAC to check

The signature is built with an unusual double-encode: HMAC-SHA512 over publicKey + rawBody + publicKey using your webhook secret key (wh_sk_), then take the digest, then (you encode the hex text, not the raw digest bytes). Use the exact raw request body — never re-serialize the JSON, or verification fails.