Olympus sends a signed event to your server when something happens, such as payment.succeeded or payout.completed. The list of event types is in the API reference.
Verify every event
Each delivery is signed with HMAC-SHA256 and carries three headers:
- X-Olympus-Event: the event type.
- X-Olympus-Timestamp: when it was sent.
- X-Olympus-Signature: the signature to check.
Compute the HMAC of the raw request body with your webhook secret and compare it to the signature. Reject the event if they differ. Use the raw body: re-serialising the JSON can change the bytes and break the check.
In the sandbox, choosing an outcome on the test checkout page sends the matching webhook, so you can test your handler without a real payment.