paypal-webhooks

Receive and verify PayPal webhooks. Use when setting up PayPal webhook handlers, debugging certificate-based signature verification, or handling payment events like PAYMENT.CAPTURE.COMPLETED, PAYMENT.SALE.COMPLETED, BILLING.SUBSCRIPTION.CREATED, or CHECKOUT.ORDER.APPROVED.

Aller à l'installation

Dépôt: hookdeck/webhook-skills
Dernière activité de la source: 11 mai 2026 à 22:26
Langue détectée de SKILL.md: anglais
Étoiles: 79
Forks: 11

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/hookdeck/webhook-skills --skill paypal-webhooks

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

20 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

woocommerce-webhooks

Receive and verify WooCommerce webhooks. Use when setting up WooCommerce webhook handlers, debugging signature verification, or handling e-commerce events like order.created, order.updated, product.created, or customer.created.

2026-08-05

square-webhooks

Receive and verify Square webhooks. Use when setting up Square webhook handlers, debugging Square signature verification, or handling payment and commerce events like payment.created, payment.updated, refund.created, invoice.payment_made, or order.updated.

2026-08-04

gocardless-webhooks

Receive and verify GoCardless webhooks. Use when setting up GoCardless webhook handlers, debugging Webhook-Signature verification, or handling bank debit events like payments confirmed, payments failed, mandates cancelled, and payouts paid.

2026-08-04

Tout voir dans ce dépôt

name	paypal-webhooks
description	Receive and verify PayPal webhooks. Use when setting up PayPal webhook handlers, debugging certificate-based signature verification, or handling payment events like PAYMENT.CAPTURE.COMPLETED, PAYMENT.SALE.COMPLETED, BILLING.SUBSCRIPTION.CREATED, or CHECKOUT.ORDER.APPROVED.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

PayPal Webhooks

When to Use This Skill

Setting up PayPal webhook handlers
Debugging PayPal signature verification failures (RSA-SHA256 with cert)
Understanding PayPal event types like PAYMENT.CAPTURE.COMPLETED
Handling payment, subscription, refund, or checkout events
Choosing between PayPal's postback verify API and offline cert verification

How PayPal Webhooks Differ From Most Providers

PayPal does not use HMAC with a shared secret. Instead, each webhook is signed with PayPal's private key, and you verify it with the matching public certificate delivered per request via the paypal-cert-url header. The algorithm is RSA-SHA256 ("SHA256withRSA").

Two valid verification paths:

Postback (no crypto needed) — POST the captured headers, your webhook_id, and the raw webhook_event body to PayPal's endpoint. Requires an OAuth access token. PayPal returns .

import os, zlib, base64, httpx from urllib.parse import urlparse from fastapi import FastAPI, Request, HTTPException from cryptography import x509 from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.asymmetric import padding from cryptography.exceptions import InvalidSignature app = FastAPI() _cert_cache: dict[str, bytes] = {} def fetch_cert(cert_url: str) -> bytes: host = urlparse(cert_url).hostname or "" if host != "paypal.com" and not host.endswith(".paypal.com"): raise ValueError("Cert URL host is not paypal.com") if cert_url in _cert_cache: return _cert_cache[cert_url] pem = httpx.get(cert_url, timeout=10).content _cert_cache[cert_url] = pem return pem def verify_paypal_webhook(headers, raw_body: bytes, webhook_id: str) -> bool: transmission_id = headers.get("paypal-transmission-id") transmission_time = headers.get("paypal-transmission-time") transmission_sig = headers.get("paypal-transmission-sig") cert_url = headers.get("paypal-cert-url") if not all([transmission_id, transmission_time, transmission_sig, cert_url]): return False crc = zlib.crc32(raw_body) & 0xFFFFFFFF message = f"{transmission_id}|{transmission_time}|{webhook_id}|{crc}".encode() cert_pem = fetch_cert(cert_url) public_key = x509.load_pem_x509_certificate(cert_pem).public_key() try: public_key.verify( base64.b64decode(transmission_sig), message, padding.PKCS1v15(), hashes.SHA256(), ) return True except InvalidSignature: return False @app.post("/webhooks/paypal") async def paypal_webhook(request: Request): raw = await request.body() if not verify_paypal_webhook(request.headers, raw, os.environ["PAYPAL_WEBHOOK_ID"]): raise HTTPException(status_code=400, detail="Invalid signature") event = await request.json() # handle event.event_type ... return {"received": True}

Header	Purpose
`paypal-transmission-id`	Unique webhook transmission ID
`paypal-transmission-time`	ISO 8601 timestamp of transmission
`paypal-transmission-sig`	Base64-encoded RSA-SHA256 signature
`paypal-cert-url`	URL of the public cert (must be a `*.paypal.com` host)
`paypal-auth-algo`	Signing algorithm, e.g. `SHA256withRSA`

Event	Description
`PAYMENT.CAPTURE.COMPLETED`	A payment capture completed
`PAYMENT.CAPTURE.REFUNDED`	A capture was refunded
`PAYMENT.SALE.COMPLETED`	A sale completed (legacy Payments API)
`BILLING.SUBSCRIPTION.CREATED`	A subscription was created
`BILLING.SUBSCRIPTION.ACTIVATED`	A subscription was activated
`BILLING.SUBSCRIPTION.CANCELLED`	A subscription was cancelled
`CHECKOUT.ORDER.APPROVED`	A buyer approved a checkout order
`CHECKOUT.ORDER.COMPLETED`	A checkout order was completed
`CUSTOMER.DISPUTE.CREATED`	A dispute was opened

paypal-webhooks

Options d'installation

Vérifiez les fichiers source

PayPal Webhooks

When to Use This Skill

How PayPal Webhooks Differ From Most Providers

PayPal Webhooks

When to Use This Skill

How PayPal Webhooks Differ From Most Providers

Essential Code (USE THIS)

Required Request Headers

Signed Message Format

Express Webhook Handler

FastAPI Webhook Handler

Common Event Types

Environment Variables

Local Development

Reference Materials

Attribution

Recommended: webhook-handler-patterns

Related Skills

paypal-webhooks

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

PayPal Webhooks

When to Use This Skill

How PayPal Webhooks Differ From Most Providers

PayPal Webhooks

When to Use This Skill

How PayPal Webhooks Differ From Most Providers

Essential Code (USE THIS)

Required Request Headers

Signed Message Format

Express Webhook Handler

FastAPI Webhook Handler

Common Event Types

Environment Variables

Local Development

Reference Materials

Attribution

Recommended: webhook-handler-patterns

Related Skills