Processing Requirements
For every callback received, you must:- Verify the signature first — See Authentication and Security for signature verification details
- Parse the business data and perform idempotent processing
- Return the agreed success response
Recommended Processing Order
To reduce the risk of duplicate processing, premature final-state decisions, or incorrect fund posting, process callbacks in the following order:- Validate headers and verify the signature
- Parse
bizType,bizId, andbizStatus - Run idempotency checks on the business-unique identifier
- Update local business state
- Return the success response
- Use query APIs for final confirmation on critical fund events
Trigger and Retry Mechanism
Trigger When the order status changes (payment success, timeout, cancellation, closure, or exception), GatePay sends a notification to your configured callback URL. Retry If you do not return the agreed success response or the request times out, GatePay will retry the callback. Signature Verification You must verify all callback signatures before processing. See Authentication and Security for details.Callback Message Structure
All callbacks contain the following top-level fields:
Example Callback:

