Notifications
SorenPay notifies you in two ways:
- Webhooks: signed JSON sent to an endpoint you give us
- Emails: sent to the person concerned
See webhook vs email for which one fires when.
What we send today
| Event | Webhook | |
|---|---|---|
checkout.session.completed | ✓ | The workspace owner |
| Business verification submitted | The person who submitted it | |
| Business verification decided | The person who submitted it, or the workspace owner | |
| Personal identity check decided (by our identity partner) | The account holder |
That's the full list for customers. Card, payout, agent and crypto events don't send a webhook or an email yet. (Our own on-call team gets an email when the ledger and the bank disagree.)
Webhook delivery
- Adding an endpoint: email support@sorenpay.com with the URL and the events you want. Self-serve endpoints in the dashboard are coming.
- Signature: every delivery carries a
sorenpay-signature: t=<unix>,v1=<hmac>header.v1is the hex HMAC-SHA256 of<t>.<raw body>with your endpoint's secret. Check it, and reject old timestamps. - Retries: any response other than 2xx, or no response within 15 seconds, is retried up to 6 attempts in total, with exponential backoff starting at 30 seconds.
- Body:
{ "id", "type", "data", "delivered_at" }.
Email delivery
Emails go out only when our email service is configured. Without it (as in some test environments) they're recorded but not delivered. There are no per-category email settings yet.