Airwallex Webhooks

When to Use This Skill

• How do I receive Airwallex webhooks?
• How do I verify Airwallex webhook signatures (x-signature / x-timestamp)?
• How do I handle payment_intent.succeeded, refund.settled, or payment_dispute.* events?
• Why is my Airwallex webhook signature verification failing?

Verification (core)

Airwallex signs every webhook with HMAC-SHA256. Two headers arrive with each request:

• x-timestamp — the send time as a Unix timestamp in milliseconds
• x-signature — the HMAC-SHA256 hex digest

The signed message is x-timestamp concatenated with the raw request body (timestamp first), keyed with the endpoint's unique secret. There is no Node SDK helper for this — verify manually and always use the original, unmodified raw body. Verify before parsing JSON.