Webhooks & event verification
Understand what is configured versus what is delivered.
Endpoint configuration
API & Webhooks can store a public HTTPS endpoint and selected sandbox event names. The interface reports webhookDispatchEnabled: false. This configuration does not mean delivery is active.
Internal payment notifications
Una Launch already authenticates incoming provider notifications, rejects duplicate/replayed events and reconciles payment state before posting. Those are platform-internal endpoints, not the merchant webhook signing protocol.
Outbound delivery is under development
A public event envelope, merchant verification keys, durable retries, replay history and SDK verification helpers are not released. Do not rely on callbacks for fulfilment yet. Review sandbox orders through the dashboard or authenticated read API.
Prepare an idempotent handler
When event delivery is released, verify the documented signature over raw bytes, enforce its time window, deduplicate durable event IDs, acknowledge after durable receipt and process side effects asynchronously. Event arrival order must never be used as the sole source of truth.