Handling The Callback

After the customer completes (or fails) the payment, Exirom sends a server-to-server POST to your callbackUrl with the final transaction status.

#Processing Steps

1. Verify the X-Checksum header — recompute the HMAC-SHA256 using accountId | orderAmount | orderCurrency | transactionId and compare. Reject if it doesn't match. See Checksum Authentication.
2. Look up the transaction by requestId or transactionId
3. Update your system based on transactionStatus
4. Return 200 OK promptly — Exirom retries on non-2xx responses

Amount format: In callbacks, amount is a numeric value (e.g. 200.0), not a string. Use the exact callback value for checksum verification — do not reuse the original request amount.

#Callback Routing

Exirom appends query parameters to your callbackUrl so you can route before reading the body:

• ?paymentMethod=apm&apmType={METHOD} — APM callbacks
• ?paymentMethod=card — card callbacks

Use apmType to select the correct parser — apmResponseData structure varies by APM.

For the full callback payload schema, see API Reference: GET /api/v1/payments/apm/info/{id}.

#Related

• Checksum Authentication — HMAC-SHA256 signing algorithm
• Webhook Best Practices — Retry handling, idempotency, security
• Webhook Callback & Transaction Lifecycle — Full webhook routing details