Paymob Webhooks

When to Use This Skill

• How do I receive Paymob webhooks (transaction callbacks)?
• How do I verify a Paymob HMAC signature?
• Why is my Paymob HMAC verification failing?
• How do I tell if a Paymob transaction succeeded, was refunded, or voided?
• Understanding the difference between the Transaction Processed Callback (POST) and Transaction Response Callback (GET)

Verification (core)

Paymob does not use Standard Webhooks, and it does not sign the raw body. Instead it computes HMAC-SHA512 over a fixed, ordered concatenation of 20 specific fields (no separators), hex-encodes it, and sends the result as the hmac query parameter on the callback URL (?hmac=<hex>). Use the HMAC secret from your Paymob dashboard.