What this page establishes
Webhook secrets authenticate message origin within the configured integration.
Callbacks can be delayed, repeated, or arrive out of order.
A webhook is not a substitute for protecting and monitoring the BTCPay deployment.
OPERATIONS · operating reference
BTCPay webhook verification guide
A signed-event workflow for linking external invoice status to an internal client record without treating an unauthenticated callback as settlement.
Reference centerConfigure settlement events
BTCPay Server Greenfield API
Practical review sequence
1
Validate the signature over the exact request body.
2
Match the store and invoice identifier.
3
Make status updates idempotent and reconcile exceptions manually.
Recheck primary sources before acting
Contracts, names, issuers, governance, bridges, providers, networks, fees, and access rules can change. CoinPork provides an operating checklist, not financial, legal, tax, accounting, or cybersecurity advice.