PayPal webhooks, without the lost events

Common problems, solved

Verifying PayPal signatures means downloading certificates and computing CRC32 checksums.

HookStead does it on arrival: it fetches PayPal's certificate from PayPal's own hosts only, caches it, and rejects anything that doesn't verify.

Sandbox and live webhooks have different IDs, and the wrong one fails every request.

Create one source per environment; each stores its own webhook ID, and rejected requests show up on the dashboard.

A payment event lost during a deploy means an order that never ships.

Events are stored before PayPal gets its answer, then retried to your endpoint until it succeeds.

Set up in five minutes

1. 01In the PayPal Developer Dashboard, open Apps & Credentials → your app → Add webhook, and paste your HookStead source URL.
2. 02Choose the event types you need and save.
3. 03Copy the webhook's ID into HookStead. PayPal signs every request with its certificate; HookStead checks it, no secret needed.