Gate G4: webhook signatures
Does signature verification accept real PayPal events and reject tampered ones? Method, evidence and limits.
Question
Does verification against the sandbox webhook id accept real events delivered by PayPal, and reject tampered ones?
Method
- Workflow:
gate-g4, by hand,mainonly. A small sandbox flow makes PayPal send real webhooks to a receiver (tools/g4-receiver): a capture of 1.00 withfinal_captureand a void of a second authorization. - The log is fetched from the receiver and every delivery goes, as received, to
POST /v1/notifications/verify-webhook-signaturewith the raw body spliced in. - Scripts:
gates/g4.tsandgates/g4-events.ts(event capture alone) inpackages/payments. - Needs the repository variable
G4_RECEIVER_URLand, by name, the secretsPAYPAL_CLIENT_ID,PAYPAL_CLIENT_SECRET,PAYPAL_WEBHOOK_ID,SANDBOX_BUYER_EMAIL,SANDBOX_BUYER_PASSWORDandG4_LOG_TOKEN.
Observed
Six real deliveries, each answered HTTP 200 with verification_status SUCCESS:
| Event | Count | Result |
|---|---|---|
| CHECKOUT.ORDER.APPROVED | 2 | SUCCESS, SUCCESS |
| PAYMENT.AUTHORIZATION.CREATED | 2 | SUCCESS, SUCCESS |
| PAYMENT.CAPTURE.COMPLETED | 1 | SUCCESS |
| PAYMENT.AUTHORIZATION.VOIDED | 1 | SUCCESS |
Six sanitized fixtures were written to packages/payments/test/fixtures/webhooks/. Real events carry fields the fake simulator lacked (event_version, resource_type, resource_version, summary, links); the fields only the simulator has are orderId, authId, captureId, amountCents and reason.
Evidence
- G4-20261105T012205Z.jsonl, sha256
6ce8f1d3...5766aa5050c, run 41947655945, 5 Nov 2026. - Fixtures: packages/payments/test/fixtures/webhooks.
Limits
The owner-run redelivery check that would close W06 is written out in docs/RUNBOOK-GATES.md. How the server handles webhooks is on the webhooks page.
- packages/payments/gates/g4.tsthe G4 script
- packages/payments/gates/g4-events.tsevent capture
- packages/payments/test/fixtures/webhookssanitized real events
- docs/RUNBOOK-GATES.mdredelivery check and failure steps
Last updated on
Gate G3: honor period and reauthorize in progress
How long an authorization stays capturable, and whether reauthorize extends it. In progress, with a simulation beside it.
Gate G5: speech accuracy partial
Is speech-to-text accurate enough to accept bids without confirmation? Not proven. On synthetic audio the numbers now meet the limit, but they were tuned on the same clips. Real numbers, method and limits.