Zenso Docs

Webhooks

Receive signed events from Zenso and fulfill orders from verified server-side signals.

Fulfillment rule

Redirects are for your customer experience. Signed webhooks are the authoritative server-side signal for fulfillment.

Verify the Zenso-Signature header using the raw request body.
Reject missing, invalid, or stale signatures.
Process each event ID once.

Events

Event	When it fires	Typical action
checkout.session.completed	A checkout session completes successfully.	Mark the checkout complete.
payment_intent.succeeded	The payment intent succeeds.	Mark the order paid.
payment_intent.failed	The payment intent fails.	Notify the customer or allow retry.
charge.captured	A charge is captured.	Record payment and release fulfillment.
charge.refunded	A charge is refunded.	Update the order or accounting state.

Verify signatures

Node.js

import crypto from "node:crypto";

export function verifyZensoWebhook(rawBody, signatureHeader, secret) {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((part) => {
      const [key, value] = part.split("=");
      return [key, value];
    })
  );

  if (!parts.t || !parts.v1) {
    return false;
  }

  const signedPayload = parts.t + "." + rawBody;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signedPayload)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(parts.v1, "hex"),
    Buffer.from(expected, "hex")
  );
}