Troubleshoot missing or rejected webhooks

First find the payment in PayerOne and determine whether the issue is payment processing or delivery to your application. A missing notification does not by itself establish that the customer has not paid.

Test the receiver

1. Open [Developer → Webhooks](https://dashboard.payerone.com/developer/webhooks).

2. Verify the saved URL, including its path.

3. Use **Test Webhook** from its action menu.

4. Check the HTTP result and your receiver logs without logging credentials or unnecessary customer data.

Use a public HTTPS URL. A private IP or localhost is not a valid dashboard webhook destination. Check that DNS, TLS, proxy routing and firewall rules allow PayerOne to POST JSON to the exact endpoint. Avoid redirecting the webhook to a sign-in page or a browser challenge.

Signature rejected

Use the merchant Private Key, not the Merchant Token. Read the unmodified request bytes before JSON parsing. Preserve `X-PayerOne-Signature` through your proxy. Check that the endpoint and key belong to the same merchant. Never disable signature verification to make a delivery appear successful.

Delivered, but the order did not update

Make sure your receiver routes the root-level `type` and `data`, recognizes the event you received, and safely queues business work. Confirm that the worker processed the queue and matched the PayerOne order ID to your local order. A `webhook.test` event must not change a customer balance.

Duplicate or slow delivery

Repeated events are expected. Use event-ID deduplication plus an idempotent payment or refund action. Acknowledge with HTTP 2xx after durable acceptance and handle slower work asynchronously. Failed or timed-out requests may be retried, so keep uncertain local operations pending while you reconcile them.

For an individual order, review the dashboard **IPN Logs** when available and perform an authenticated order lookup. If support is needed, provide the order reference, approximate time and time zone, endpoint origin/path without any secret query value, and the safe HTTP error. Redact signatures, keys and authorization headers.