Skip to main content

Create a payment session

POST 
/api/payment-sessions

Creates a new payment session and returns the session details. After payment completion, a webhook will be sent to your configured endpoint. See callbacks below for more details on the webhook payload.

Request​

Responses​

Payment session created successfully

Callbacks​

POST 
{$your-configured-webhook-endpoint}

[OUTGOING EVENT] Sent when a payment is successful.

[DOCUMENTATION ONLY] This webhook is sent by our system to your configured endpoint when the corresponding payment event occurs.

Security & Signature​

All webhook requests include a x-OpenHive-Signature header to allow you to verify that the request was sent by OpenHive and has not been tampered with.

Signature format: t=TIMESTAMP,v1=HMAC_SHA256

How to verify:

  1. Extract the timestamp t and the signature v1 from the header.
  2. The signature is an HMAC with the SHA-256 hash function.
  3. It is computed using your webhook secret as the key and the JSON-encoded payload as the message.

Example implementation (PHP):

$payload = file_get_contents('php://input'); // Raw request body
$header = $_SERVER['HTTP_X_OPENHIVE_SIGNATURE']; // t=1737035345,v1=hash...

// Extract v1 from header
if (preg_match('/v1=([^,]+)/', $header, $matches)) \{
    $receivedHmac = $matches[1];
\}

// Compute expected HMAC (using the same logic as OpenHive)
$expectedHmac = hash_hmac('sha256', json_encode(json_decode($payload)), $secret);

if (hash_equals($expectedHmac, $receivedHmac)) \{
    // Valid signature
\}