PayPal Webhooks

When to Use This Skill

• Setting up PayPal webhook handlers
• Debugging PayPal signature verification failures (RSA-SHA256 with cert)
• Understanding PayPal event types like PAYMENT.CAPTURE.COMPLETED
• Handling payment, subscription, refund, or checkout events
• Choosing between PayPal's postback verify API and offline cert verification

How PayPal Webhooks Differ From Most Providers

PayPal does not use HMAC with a shared secret. Instead, each webhook is signed with PayPal's private key, and you verify it with the matching public certificate delivered per request via the paypal-cert-url header. The algorithm is RSA-SHA256 ("SHA256withRSA").

Two valid verification paths: