Skip to main content

Processing Requirements

For every callback received, you must:
  1. Verify the signature first — See Authentication and Security for signature verification details
  2. Parse the business data and perform idempotent processing
  3. Return the agreed success response
Since the same business event may be delivered more than once, you must implement idempotency using a business-unique identifier. To reduce the risk of duplicate processing, premature final-state decisions, or incorrect fund posting, process callbacks in the following order:
  1. Validate headers and verify the signature
  2. Parse bizType, bizId, and bizStatus
  3. Run idempotency checks on the business-unique identifier
  4. Update local business state
  5. Return the success response
  6. Use query APIs for final confirmation on critical fund events
For payment, refund, reward-distribution, and other fund-related flows, callbacks should usually be treated as the primary event source, while final confirmation for critical outcomes should still be verified through the relevant query APIs.

Trigger and Retry Mechanism

Trigger When the order status changes (payment success, timeout, cancellation, closure, or exception), GatePay sends a notification to your configured callback URL. Retry If you do not return the agreed success response or the request times out, GatePay will retry the callback. Signature Verification You must verify all callback signatures before processing. See Authentication and Security for details.

Callback Message Structure

All callbacks contain the following top-level fields: Example Callback:

Callback Acknowledgement Response

Return the following JSON response with HTTP 200:
HTTP 200 status is recommended to indicate successful receipt.