Malaleem API

Webhooks & signatures

Malaleem POSTs a JSON event `{id, type, created, data}` to your webhook URL with an `X-Malaleem-Signature: t=<unix>,v1=<hex>` header. Verify it with HMAC-SHA256 over `"<t>.<raw_body>"` using your webhook secret, and reject timestamps older than ~5 minutes. `id` is stable across retries — use it to ignore duplicates. `data` is the checkout session (`data.id` is its id). Event types: `payment.succeeded`, `payment.cancelled`, `payment.failed`, `payment.expired`, `payment.refunded` (whose `data.refund` is `{id, amount, currency, status}`). The WooCommerce plugin exposes the receiver at `/wp-json/malaleem/v1/webhook`.