Building a PHP Webhook Receiver

Build an HTTP endpoint that authenticates, acknowledges and processes external event notifications. The examples separate the essential operation from the conditions a production implementation must enforce.

What It Does

Build an HTTP endpoint that authenticates, acknowledges and processes external event notifications.

Prerequisites

Use a dedicated development environment with test accounts and records. Separate authorization, validation and error handling from response formatting; never copy demonstration-only secrets into production.

Example 1: Core Behavior

This scenario applies the exact rule described in the guide, with controlled sample values.

<?php
$raw=file_get_contents("php://input"); $max=65536;
if ($raw===false||strlen($raw)>$max){http_response_code(413);exit;}
echo "Body length: ".strlen($raw);

Example 2: Alternative or Failure Case

This scenario applies the exact rule described in the guide, with controlled sample values.

<?php
$eventId="evt_32"; $processed=["evt_20"=>true];
if(isset($processed[$eventId])) {http_response_code(200);echo "Already processed";} else {http_response_code(202);echo "Enqueue once";}

Practical Example: Applying the Rule

This practical workflow performs the relevant operation, with strict error checks. Configure the required transport or database driver before running it.

<?php
$secret = getenv('WEBHOOK_SECRET');
if (!$secret) throw new RuntimeException('Missing webhook signing secret');
$raw = file_get_contents('php://input');
if ($raw === false || strlen($raw) > 65536) { http_response_code(413); exit; }
$header = (string) ($_SERVER['HTTP_X_SIGNATURE'] ?? '');
if (!preg_match('/^sha256=([a-f0-9]{64})$/D', $header, $matches)) { http_response_code(401); exit; }
$expected = hash_hmac('sha256', $raw, $secret);
if (!hash_equals($expected, $matches[1])) { http_response_code(401); exit; }
$event = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
if (!is_string($event['id'] ?? null)) { http_response_code(422); exit; }
// Before acknowledging, persist the event ID with a UNIQUE constraint and enqueue the work atomically.
http_response_code(202);
echo 'Signature verified; ready for idempotent processing';

Important Behavior and Edge Cases

Check message signature and persist deduplication ID before applying side effects.

Comparison with Related Functions or Patterns

Common Beginner Mistakes

Key Takeaways

• Build an HTTP endpoint that authenticates, acknowledges and processes external event notifications.
• Check message signature and persist deduplication ID before applying side effects.
• Outgoing webhooks sign and deliver messages in the opposite direction.

Select this API or pattern based on its documented behavior and the trust boundaries in your own application, and test all external integrations against their actual deployments.