https://merchant.example.com/api/webhooks/splashpay

POST /api/webhooks/splashpay HTTP/1.1

Content-Type: application/json
X-Webhook-Event: disbursement.success
X-SplashPay-Timestamp: 2026-07-05T14:25:40Z
X-SplashPay-Signature: 8b0f8eb9a6c5a7c6...

{
  "event": "disbursement.success",
  "created_at": "2026-07-05T14:25:40Z",
  "data": {
    "reference": "PAYOUT-100001",
    "provider_reference": "S20618298751",
    "amount": "50000.00",
    "currency": "TZS",
    "status": "success",
    "provider": "selcom",
    "channel": "MOBILE_MONEY",
    "network": "MPESA",
    "phone": "255747123456",
    "metadata": {
      "employee_id": "EMP-1001"
    }
  }
}

HMAC SHA-256

signature = HMAC_SHA256(
    webhook_secret,
    raw_request_body
)

public function handle(Request $request)
{
    // Raw request body
    $payload = file_get_contents('php://input');

    // Headers
    $signature = $request->header('X-SplashPay-Signature');
    $timestamp = $request->header('X-SplashPay-Timestamp');
    $event = $request->header('X-Webhook-Event');

    // Verify signature
    if (!$this->verifySignature($payload, $signature)) {
        return response()->json([
            'message' => 'Invalid signature'
        ], 400);
    }

    $data = json_decode($payload, true);

    switch ($event) {

        case 'disbursement.success':

            // Mark payout as completed

            break;

        case 'disbursement.failed':

            // Mark payout as failed

            break;

        case 'disbursement.cancelled':

            // Mark payout as cancelled

            break;
    }

    return response()->json([
        'status' => 'ok'
    ]);
}

protected function verifySignature(
    string $payload,
    string $signature
): bool {

    $expected = hash_hmac(
        'sha256',
        $payload,
        config('services.splashpay.webhook_secret')
    );

    return hash_equals(
        $expected,
        $signature
    );
}

{
    "status": "ok"
}