How can I authenticate that a webhook is from the TransactAPI server?

We offer encrypted webhook services fort webhook authentication. You can set your webhook key in the "Administrative" tab of the TransactAPI admin panel.

The encryption method is symmetric key based encryption. The response set of a given method is used as the payload and is encrypted with that given key and transmitted (ie POSTed) to the webhook registered. You need to use the same key to decrypt it on the receiving end.

The encryption method used is AES-256-CBC

Here is a code snippet to assist with implementation