Configure and validate Adyen HMAC webhook signature verification for notification security

Steps

1. Generate an HMAC key in the Adyen Customer Area for your notification webhook endpoint and store it securely in your server environment
2. For each incoming notification item, extract the fields required for HMAC computation: value, currency, merchantReference, PSP reference, event code, and success flag in the correct canonical order
3. Concatenate these fields using the colon-separated format specified in Adyen's documentation and compute an HMAC-SHA256 digest using your HMAC key
4. Compare the computed digest to the additionalData.hmacSignature field in the notification using a constant-time comparison; reject notifications where signatures do not match
5. Return an HTTP 200 response with the body content Adyen expects to acknowledge receipt; failure to acknowledge will cause Adyen to retry the notification
6. Implement idempotency using the PSP reference and event code combination to prevent duplicate processing of retried notifications