Use Test mode to exercise webhooks with simulated transactions before going Live.
SePay sends an HTTP POST to your URL on every transaction. Your endpoint receives the request, processes it, and returns 200.
1. Write the webhook endpoint
Integration Overview
<?php$payload = json_decode(file_get_contents('php://input'), true);// Handle payload hereheader('Content-Type: application/json');http_response_code(200);echo json_encode(['success' => true]);
Deploy your endpoint to a real URL that's reachable from the Internet. Use HTTPS in production; HTTP is fine for local testing only.
2. Create the webhook
Dashboard → Webhooks → Thêm webhook (Add webhook):
| Field | Value |
|---|---|
| Tên (Name) | Anything |
| URL | The endpoint you just deployed |
| Loại giao dịch (Transaction type) | Tất cả (All) |
| Tài khoản ngân hàng (Bank account) | Tất cả tài khoản (All accounts) |
| Phương thức xác thực (Auth method) | Không xác thực (None) |
After saving, open the ⋮ menu on the new webhook row, then click Gửi thử (Test send). If the result is Thành công (Success) your URL has received the webhook successfully.
3. Test with a real transaction
Transfer a small amount (e.g. 10,000₫) into a bank account linked to SePay. SePay sends the webhook to your endpoint within a few seconds.
Open Delivery logs and click the latest log row. If Status shows Success, your endpoint received the webhook. Switch to the Request tab to see the actual payload (the data SePay sent):
{
"id": 92704,
"gateway": "Vietcombank",
"transactionDate": "2024-07-02 11:08:33",
"accountNumber": "1017588888",
"subAccount": "",
"code": null,
"content": "NGUYEN VAN A chuyen tien",
"transferType": "in",
"transferAmount": 10000,
"accumulated": 105010000,
"referenceCode": "FT24012345678"
}Full field explanation: Integrate webhook.
Enable HMAC-SHA256 authentication, deduplicate using the id field, and validate transferAmount matches your expected order amount before processing. See Integrate webhook for the full guide.
Next
- Bank accounts: supported banks, VA, money in/out
- Integrate webhook: full payload, valid response, deduplication, MySQL example
- Authentication: HMAC-SHA256, API Key, OAuth 2.0
- Webhook not firing?: diagnostic checklist
- Reconciliation: never miss a transaction