POST callback that Cashfree sends to a URL you register when a specific event occurs in your account, such as a payment confirmation, a payout reversal, or a KYC session outcome. Every webhook is signed with HMAC-SHA256 using your client secret. Signature verification is required before you process any payload.
When to use webhooks
Use webhooks for any outcome that is asynchronous (not known immediately when the API returns):- A bank confirmation arrives after a payment is initiated.
- A beneficiary bank reverses a payout.
- A Video KYC session is reviewed by an auditor.
- A wallet credit completes after a fund transfer.
For business-critical flows, combine webhooks with an API poll as a fallback. Webhooks are near real time but are not guaranteed to arrive within your application timeout.
Webhooks by product
Each product area has its own webhook entry point, linked below.Payment Gateway webhooks
Setup, event references, signature verification, and troubleshooting for Payment Gateway webhooks.
Payouts webhooks
Payouts V2 and V1 webhook references, Cashgram, and product documentation in one place.
Secure ID webhooks
Video KYC, BAV V2, reverse penny drop, DigiLocker, KYC links, e-sign, and signature verification.
PPI webhooks
Wallet credit and PPI webhook verification and wallet management webhook references.
Partner platform webhooks
Merchant onboarding and other platform webhook entry points in the Partners APIs.
What you need to do
Complete these steps to receive and process Cashfree webhooks reliably.1
Choose products and events
Identify which products you integrate with and which events to handle. Use Events by product as a starting point.
2
Implement an HTTPS endpoint
Build a publicly reachable HTTPS URL that accepts
POST requests, reads the raw body for signature verification, and returns 200 quickly.3
Register the URL in the Merchant Dashboard
Open Add Webhook Endpoint under the product’s developer settings, enter your URL, and click Test to verify it. Then select a retry policy and the events to subscribe to, and save. See Configure webhook endpoints for dashboard paths.
4
Verify signatures on every request
Reject any payload that fails cryptographic verification. See Payloads and signature verification for the algorithm per product family.
5
Acknowledge immediately and process asynchronously
Return
200 after signature verification, then process the event in a background worker. Non-200 responses trigger retries.6
Handle retries and idempotency
Webhooks follow at-least-once delivery. Store processed event IDs to prevent duplicate side effects. See Reliability and operations.
7
Test, then go live
Exercise flows in sandbox and confirm payloads against the product reference before enabling in production.