Handling The Callback

After the customer completes (or fails) the payment, Exirom sends a server-to-server POST to your callbackUrl with the final transaction status.

#Processing Steps

1. Verify the X-Checksum header — recompute the unchanged APM-payment HMAC-SHA256 using accountId | orderAmount | orderCurrency | transactionId and compare. Reject if it doesn't match. See Checksum Authentication.
2. Look up the transaction by requestId or transactionId
3. Update your system based on transactionStatus
4. Return 200 OK promptly — Exirom retries on non-2xx responses

Amount format: In APM-payment callbacks, orderAmount is a numeric value (e.g. 200.0), not a string. Use its exact callback representation for checksum verification — do not reuse the original request amount.

#Callback Routing

Exirom appends query parameters to your callbackUrl so you can route before reading the body:

• ?paymentMethod=apm&apmType={METHOD} — APM callbacks
• ?paymentMethod=card — card callbacks

Use apmType to select the correct parser — apmResponseData structure varies by APM.

For the full callback payload schema, see API Reference: GET /api/v1/payments/apm/info/{id}.

#Related

• Checksum Authentication — HMAC-SHA256 signing algorithm
• Webhook Best Practices — Retry handling, idempotency, security
• Webhook Callback & Transaction Lifecycle — Full webhook routing details