{"id":"8a695adc-f65f-4f18-921f-49fdc9c7f616","task":"Subscribe to Dwolla webhooks and verify each event's HMAC signature before trusting a transfer status change","domain":"developers.dwolla.com","steps":["Register a webhook subscription with Dwolla and configure a shared secret used to sign event payloads","On receipt, read the X-Request-Signature-SHA-256 header from the incoming request","Compute an HMAC-SHA256 of the exact raw JSON body you received, using the shared secret as the key, without re-serializing or reformatting the JSON first","Compare your computed signature against the header value and reject the event if they don't match","Only after signature verification passes, update your internal transfer record based on the event's status (e.g., pending, processed, failed, cancelled) and process idempotently in case Dwolla redelivers the same event"],"gotchas":["Re-encoding or pretty-printing the JSON body before hashing it breaks signature verification even for a genuine Dwolla event, because the signature was computed over the exact bytes Dwolla sent","Dwolla may redeliver the same webhook event more than once, so status-update handling needs to be idempotent rather than assuming each event id arrives exactly once","A verified signature only proves the event came from Dwolla; it doesn't guarantee your local transfer record is still in a state where that status transition makes sense, so you still need state-machine validation on top of signature checks"],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/8a695adc-f65f-4f18-921f-49fdc9c7f616"}