Webhook Notifications¶

Adyen sends signed webhook events to the plugin's standard notification endpoint. These are processed asynchronously.

Endpoint¶

https://{site_url}/wc-api/adyen-standard

Registered via the WooCommerce API hook woocommerce_api_adyen-standard in API\Notifications\NotificationEndpoints.

Configure this URL in the Adyen Customer Area under Developers → Webhooks.

Processing flow¶

sequenceDiagram
    participant Adyen
    participant NotificationEndpoints
    participant NotificationHandlers
    participant NotificationStore (DB)
    participant Action Scheduler
    participant NotificationScheduler

    Adyen->>NotificationEndpoints: POST /wc-api/adyen-standard
    NotificationEndpoints->>NotificationHandlers: standard()
    NotificationHandlers->>NotificationHandlers: Security::is_authenticated_notification()
    loop Each notificationItem
        NotificationHandlers->>NotificationStore (DB): Find by pspReference + eventCode
        alt New or updated notification
            NotificationStore (DB)-->>NotificationHandlers: Save/update record
        end
    end
    NotificationHandlers-->>Adyen: [accepted]

    Note over Action Scheduler,NotificationScheduler: Every 120 seconds
    Action Scheduler->>NotificationScheduler: adyen_process_notifications
    NotificationScheduler->>NotificationStore (DB): Fetch unprocessed (limit 20)
    loop Each notification
        NotificationScheduler->>WordPress: do_action('adyen/notification/{event_code}', $notification)
        NotificationScheduler->>NotificationStore (DB): Mark processed = true
    end

Event codes¶

Notification processing is hook-based. Handlers register on adyen/notification/{event_code} (lowercased). Common event codes from Adyen:

See API\Notifications\NotificationEventCodeHandlers for registered handlers.

HMAC validation¶

Adyen signs each notification with an HMAC-SHA256 signature. The plugin verifies this in API\Notifications\Security. The HMAC key is configured in the gateway settings (stored in the database, never in code).

Note: HMAC validation is currently commented out in NotificationHandlers::standard(). It should be re-enabled in production.

Deduplication¶

The handler checks for an existing notification with the same pspReference and eventCode before saving. If a newer or equal notification arrives for an already-processed entry, a new record is created so it can be reprocessed.