paystack-browser-webhooks

name	paystack-browser-webhooks
description	Use when an agent considers Paystack webhook handling while using @alexasomba/paystack-browser; explains why webhook verification belongs on a server and not in browser code.
license	MIT
compatibility	Modern browsers and bundlers; package tooling/SSR builds require Node.js >=22.0.0; ESM package; public-key frontend runtime only.

Paystack Browser Webhook Boundary

Do not handle or verify Paystack webhooks in browser code. Webhooks are server-to-server events and require your Paystack secret key.

Correct architecture

• Browser starts or resumes a payment using public-key-safe flows.
• Backend verifies transaction state using a server SDK.
• Backend receives Paystack webhooks on a server route.
• Backend verifies the raw webhook body with the Paystack secret key.

Do not do this in browser code

• Do not expose sk_test_* or sk_live_*.
• Do not verify x-paystack-signature in frontend JavaScript.
• Do not fulfill orders based only on browser callbacks.
• Do not trust client-submitted webhook payloads.

Recommended path

Use @alexasomba/paystack-node or @alexasomba/paystack-axios on the backend for webhook verification, then update durable application state from the verified event.