Loading...
Loading...
Learn how to test and debug PayPal payment webhooks using Webhook.it. This guide covers webhook events, signature verification, and best practices for payment integrations.
PayPal webhooks are HTTPS callbacks that notify your application when events occur in your PayPal account. Instead of polling the API, webhooks push data to your server in real-time when payments are completed, subscriptions change, or disputes are filed.
PayPal webhooks have replaced the older IPN (Instant Payment Notification) system. Webhooks are faster, more reliable, and support automatic retries - up to 25 attempts over 3 days until your server responds with a 2xx status code.
PayPal sends webhooks for various event types. Here are the most commonly used events you should test during development:
PAYMENT.CAPTURE.COMPLETED - Payment was successfully capturedPAYMENT.CAPTURE.DENIED - Payment capture was deniedPAYMENT.CAPTURE.REFUNDED - Payment was refundedPAYMENT.CAPTURE.REVERSED - Payment was reversedCHECKOUT.ORDER.APPROVED - Buyer approved the orderCHECKOUT.ORDER.COMPLETED - Order was completedCHECKOUT.PAYMENT-APPROVAL.REVERSED - Payment approval reversedBILLING.SUBSCRIPTION.CREATED - New subscription createdBILLING.SUBSCRIPTION.ACTIVATED - Subscription activatedBILLING.SUBSCRIPTION.CANCELLED - Subscription cancelledBILLING.SUBSCRIPTION.SUSPENDED - Subscription suspendedPAYMENT.SALE.COMPLETED - Subscription payment completedCUSTOMER.DISPUTE.CREATED - Customer opened a disputeCUSTOMER.DISPUTE.RESOLVED - Dispute was resolvedCUSTOMER.DISPUTE.UPDATED - Dispute status changedGo to Webhook.it homepage and copy your unique webhook URL. This URL will receive all webhook events from PayPal.
Log in to the PayPal Developer Dashboard. Go to My Apps & Credentials and select your REST application. Under Webhooks, click Add Webhook and paste your Webhook.it URL. Select the event types you want to receive.
Important: PayPal only delivers webhooks to HTTPS URLs on port 443. Webhook.it URLs are fully compatible.
PayPal provides a Webhook Simulator in the Developer Dashboard. Enter your Webhook.it URL, select a sample event type, and click Send Test. The event will be queued and delivered within a minute.
Return to Webhook.it to see the captured request. PayPal webhooks include the event type in the event_type field and the resource data in the resource object.
Here's what a PAYMENT.CAPTURE.COMPLETED webhook looks like:
{
"id": "WH-1234567890-ABCDEFGH",
"event_type": "PAYMENT.CAPTURE.COMPLETED",
"create_time": "2025-01-15T10:30:00.000Z",
"resource_type": "capture",
"resource": {
"id": "5O190127TN364715T",
"status": "COMPLETED",
"amount": {
"currency_code": "USD",
"value": "100.00"
},
"seller_protection": {
"status": "ELIGIBLE"
},
"final_capture": true
},
"summary": "Payment completed for $100.00 USD"
}In production, always verify webhook signatures to ensure requests come from PayPal. Check these headers in Webhook.it:
Use Webhook.it to get a free public URL instantly. Configure this URL in the PayPal Developer Dashboard under My Apps & Credentials > Webhooks. Use the Webhook Simulator to send test events, or trigger real events in sandbox mode.
Webhooks are the modern, recommended approach - they're faster, support more event types, and have better retry logic (25 retries over 3 days). IPN (Instant Payment Notification) is legacy and may be deprecated. New integrations should use webhooks.
Key events include: PAYMENT.CAPTURE.COMPLETED (successful payment), PAYMENT.CAPTURE.DENIED (failed payment), BILLING.SUBSCRIPTION.CREATED/ACTIVATED/CANCELLED (subscriptions), and CHECKOUT.ORDER.APPROVED (checkout completion).
PayPal sends a signature in the headers. Verify by computing CRC32 of the message and validating the signature, or POST the message back to PayPal's verify-webhook-signature endpoint with your webhook ID and transmission headers.
Common issues: 1) Check if you're in Sandbox vs Live mode, 2) Verify the webhook URL is HTTPS on port 443, 3) Ensure your endpoint returns 2xx status quickly, 4) Check the Webhook Events dashboard in PayPal for delivery attempts and errors.