Developer Discussions

Hi, how can I secure that actually the caller of the webhook endpoint is PayMaya? Do you send some secret key as a header?

Other payment providers usually sign the data or use something else to prove that the data is send actually by PayMaya.