Active Listener
Dragonpay Postback Endpoint

This endpoint automatically listens for incoming callbacks from Dragonpay and validates them against RSA-SHA256 (asymmetric public keys), HMAC-SHA256, or SHA-1 Digest.

Simulate a Webhook Call via cURL:
curl -X POST "https://vsdevs.duckdns.org/postback.php" \
  -d "txnid=txn_demo123" \
  -d "refno=123456789" \
  -d "status=S" \
  -d "message=SUCCESS" \
  -d "amount=100.00" \
  -d "param1=UAT" \
  -d "procid=TEST"
Open Postback Log Viewer Manage RSA Keys
Supported Signature Methods
1. RSA-SHA256 Recommended

Dragonpay signs the payload with its private key. Verified using public key PEM cached from Dragonpay callback keys API.

2. HMAC-SHA256 Standard

Payload hashed using merchant secret key: txnid:refno:status:message:amount.

3. Legacy SHA-1 Digest Legacy

Hashed via SHA-1: txnid:refno:status:message:collectionKey.