Square
Square webhook receiver
POST
Called by Square, not by partners. Verified with the x-square-hmacsha256-signature
header over the raw body and the full notification URL. Acknowledged immediately and
processed asynchronously: payment.created is always stored, payment.updated only
when the payment is COMPLETED, other events are ignored. Events for merchants with no
connected terminal are dropped. Re-deliveries are stored once.
x-square-hmacsha256-signature*stringapplication/json- body
Square's webhook envelope. Only payment events are used.
merchant_id*stringtype*stringevent_id*stringcreated_at?stringFormat
date-timedata*Received.
application/json- response
received?unknowncurl -X POST "https://example.com/square/webhook" \ -H "x-square-hmacsha256-signature: string" \ -H "Content-Type: application/json" \ -d '{ "merchant_id": "string", "type": "payment.created", "event_id": "string", "data": {} }'{ "received": true}