--- name: paystack-browser-webhooks description: Use when an agent considers Paystack webhook handling while using @alexasomba/paystack-browser; explains why webhook verification belongs on a server and not in browser code. license: MIT compatibility: "Modern browsers and bundlers; package tooling/SSR builds require Node.js >=22.0.0; ESM package; public-key frontend runtime only." --- # Paystack Browser Webhook Boundary Do not handle or verify Paystack webhooks in browser code. Webhooks are server-to-server events and require your Paystack secret key. ## Correct architecture - Browser starts or resumes a payment using public-key-safe flows. - Backend verifies transaction state using a server SDK. - Backend receives Paystack webhooks on a server route. - Backend verifies the raw webhook body with the Paystack secret key. ## Do not do this in browser code - Do not expose `sk_test_*` or `sk_live_*`. - Do not verify `x-paystack-signature` in frontend JavaScript. - Do not fulfill orders based only on browser callbacks. - Do not trust client-submitted webhook payloads. ## Recommended path Use `@alexasomba/paystack-node` or `@alexasomba/paystack-axios` on the backend for webhook verification, then update durable application state from the verified event.