Skip to main content
This issue may arise due to multiple reasons, such as:
  • High latency in response to the test payload.
  • Webhook endpoint didn’t return HTTP 200 OK.
To troubleshoot this issue, follow this step: Ensure your webhook endpoint returns a 200 OK response within 50 ms during configuration.
This issue may arise due to multiple reasons, such as:
  • Parsed payload is being used.
  • Timestamp provided in the ‘x-webhook-timestamp’ isn’t used for creating the signed payload.
To troubleshoot this issue, follow these steps:
  • Use the raw payload and x-webhook-timestamp to generate the signed payload.
  • Sign it using your client secret and HMAC SHA256.
  • Refer here for the sample code.
This issue may arise due to multiple reasons, such as:
  • Endpoint not returning 200 OK.
  • Required events not selected.
  • Endpoint expects a non-JSON format.
  • Payment is still in an intermediate state.
To troubleshoot this issue, follow these steps:
  • Ensure the endpoint returns 200 OK and can parse JSON.
  • Use the Get Payment Status API to check the payment status.
This issue arises because HTTP (instead of HTTPS) webhook endpoint configured in production.To troubleshoot this issue, follow this step:
  • Use only HTTPS URLs for webhook endpoints in the production environment.
This error occurs when production API keys are not generated for your merchant account. To generate them:
  1. Log in to the Merchant Dashboard.
  2. Click Switch to Prod at the top right.
  3. Click Developers at the top right.
  4. Click API Keys under Payment Gateway.
  5. Click Generate API Keys and complete two-factor authentication.
After the keys are generated, you can configure your production webhooks.
Receiving duplicate webhook events for a single successful payment can occur when multiple webhook versions are enabled for your account. Identify which webhook version you intend to use, then raise a request through the Support Form. Cashfree disables the unused version. This control is not available in the Merchant Dashboard.For other causes, including retries and duplicate subscriptions, see Receiving duplicate webhook events.
For comprehensive security guidelines including IP whitelisting, signature verification, and SSL configuration, refer to the Webhook Security Checklist.