Adyen webhook payload example (AUTHORISATION)

Adyen · event: AUTHORISATION · content type: application/json

This is a representative sample — fake IDs, real structure. To see a payload with your data, point the provider at a capture URL (button below).

Headers

content-type: application/json

Body

{
  "live": "false",
  "notificationItems": [
    {
      "NotificationRequestItem": {
        "additionalData": {
          "hmacSignature": "coqCmt/IZ4E3CzPvMY8zTjQVL5hYJUiBRg8UU+iCWo0="
        },
        "amount": {
          "value": 1130,
          "currency": "EUR"
        },
        "pspReference": "7914073381342284",
        "eventCode": "AUTHORISATION",
        "eventDate": "2019-05-06T17:15:34.121+02:00",
        "merchantAccountCode": "TestMerchant",
        "operations": [
          "CANCEL",
          "CAPTURE",
          "REFUND"
        ],
        "merchantReference": "TestPayment-1407325143704",
        "paymentMethod": "visa",
        "success": "true"
      }
    }
  ]
}

Things that bite people

• This is Adyen's own documented sample, and its signature actually verifies — against the sample HMAC key from their docs: 44782DEF547AAA06C910C43932B1EB0C71FC68D9D0C057550C48EC2ACF6BA056. Try it in the signature debugger (Adyen provider: paste the whole body + that key) or set the Adyen scheme on a capture bin for live ✓/✗ badges.
• Adyen signs extracted fields, not the raw body. The signed string here is 7914073381342284::TestMerchant:TestPayment-1407325143704:1130:EUR:AUTHORISATION:true — 8 values (pspReference:originalReference:merchantAccountCode:merchantReference:amount.value:amount.currency:eventCode:success) joined with colons; empty fields (like originalReference here) stay empty, hence the double colon. HMAC-SHA256, base64. Upside: proxies that re-serialize JSON can't break this signature. Downside: raw-body HMAC verifiers (most generic testers) structurally can't check it.
• Hex-decode the key before keying — the Customer Area gives you a hex string, and every official library does Buffer.from(key, "hex"). Feeding the hex characters straight into the HMAC is the classic Adyen bug: with this sample you'd compute v1SgtPdCljLGt5Ln1m/87X4DF+iNzvtUfStAjQlfiWw= instead of the correct signature.
• Don't escape anything. Blog posts about Adyen HMAC often mention escaping : and \ in values — in the official libraries that replacer only applies to the legacy sorted-map variant (classic HPP), not to NotificationRequestItem field signing. Note also: success and live are JSON strings ("true"), while amount.value is an integer in minor units — build the signed string from parsed values, not from guesses about types.
• notificationItems is an array: batches are possible and each item carries its own hmacSignature — verify every one. Dedupe on eventCode + pspReference: Adyen docs say duplicates can arrive with a different eventDate, and you should trust the latest.
• Accepting: respond with any 2xx (200/202) within 10 seconds, and acknowledge before running business logic — per current docs, acceptance is judged on the status code alone (the legacy [accepted] response body older integrations still send is no longer required). Your endpoint must be publicly reachable without redirects.
• Retries queue per endpoint, in order: after a failure Adyen retries at 9s/18s/27s, then from a retry queue at 2m/5m/10m/15m/30m/1h/2h/4h/8h intervals for up to 30 days. Delivery is sequential — "if a retry is successful, we continue with the next webhook in the queue" — so one failing event delays everything behind it, and when your endpoint recovers the whole backlog arrives in a burst (their own troubleshooting doc warns about self-inflicted 429s). Failure alerts fire after 5 attempts and again at 7 days; the Customer Area has manual Retry/Ignore per event.
• Banking and Management ("other") webhooks sign differently: base64 HMAC-SHA256 over the raw body, delivered in an hmacsignature header alongside protocol: HmacSHA256 — same hex key format. A bin with the Adyen scheme falls back to that automatically when the body has no notificationItems. One HMAC key per endpoint; generate a fresh key when going test→live, and keep accepting the old key briefly during rotation — Adyen warns propagation takes time.

Send it yourself

Reproduce this delivery against any endpoint (your handler, a bin, staging):

$ curl -X POST https://your-endpoint.example/hook \
  -H 'content-type: application/json' \
 -d '{"live":"false","notificationItems":[{"NotificationRequestItem":{"additionalData":{"hmacSignature":"coqCmt/IZ4E3CzPvMY8zTjQVL5hYJUiBRg8UU+iCWo0="},"amount":{"value":1130,"currency":"EUR"},"pspReference":"7914073381342284","eventCode":"AUTHORISATION","eventDate":"2019-05-06T17:15:34.121+02:00","merchantAccountCode":"TestMerchant","operations":["CANCEL","CAPTURE","REFUND"],"merchantReference":"TestPayment-1407325143704","paymentMethod":"visa","success":"true"}}]}'

← All payload examples · Related guide · Signature debugger · Docs