How to Decrypt the Webhook Payload
Verify and decode the encrypted data field returned in Transak webhook events
Transak sends the webhook payload in the data field as a signed JWT. To read the actual order or KYC payload, verify the JWT using your Partner Access Token and then decode its claims on your backend.
Before You Start
- Your webhook endpoint must already be configured with Transak.
- You need a valid Partner Access Token. Follow How to Create a Partner Access Token.
- Perform verification and decoding only on your server. Do not expose the access token in frontend code.
Always verify the JWT signature before trusting any webhook data. Do not decode the payload without verification.
How It Works
When Transak sends a webhook, the payload includes an encrypted data field. Your backend should: