Payments Integration Guide
Test Square Webhooks Online
Test Square payment, order, and customer inventory webhooks with full HMAC verification.
Direct Answer / Quick Summary
To test Square webhooks, open Square Developer Dashboard > Webhooks > Subscriptions, add your SafeWebhook URL, and trigger test events in the Square Sandbox.
Key Capabilities & Testing Highlights
- •Square signature requires hashing notification URL + raw body.
- •Inspect payment.updated, order.created, and inventory.count.updated.
- •Sub-20ms edge capture and inspection.
- •Replay Square POS payloads directly to localhost.
Signature Header
X-Square-HMAC-SHA256-Signature
Cryptographic Scheme
HMAC-SHA256 (Notification URL + Body Scheme)
Payload Retention
100% Client-Side
Step-by-Step Square Webhook Setup
Follow these 4 simple steps to capture real-time Square events in your browser:
1
In Square Developer Dashboard, select your application.
2
Click Webhooks in the left sidebar and click "Add subscription".
3
Enter your SafeWebhook URL and select Sandbox/Production events.
4
Click "Save" and click "Send test event".
Sample Square Webhook Payload
application/json{
"merchant_id": "ML2938491029",
"type": "payment.updated",
"event_id": "89102938-1029-4829-1029-102938491029",
"created_at": "2026-08-19T12:00:00Z",
"data": {
"type": "payment",
"id": "pay_9812491029",
"object": {
"payment": {
"id": "pay_9812491029",
"amount_money": {
"amount": 1500,
"currency": "USD"
},
"status": "COMPLETED"
}
}
}
}Square Signature Verification Recipes
Copy-paste production-ready HMAC verification code for your backend:
Node.js / Express Recipecrypto.timingSafeEqual
const crypto = require('crypto');
function verifySquareSignature(webhookUrl, rawBody, signature, secretKey) {
const combined = webhookUrl + rawBody;
const hmac = crypto.createHmac('sha256', secretKey).update(combined).digest('base64');
return crypto.timingSafeEqual(Buffer.from(hmac), Buffer.from(signature));
}Python / Flask / FastAPI Recipehmac.compare_digest
import hmac
import hashlib
import base64
def verify_square_signature(webhook_url, raw_body, signature, secret_key):
combined = webhook_url.encode('utf-8') + raw_body
computed = base64.b64encode(hmac.new(secret_key.encode('utf-8'), combined, hashlib.sha256).digest()).decode('utf-8')
return hmac.compare_digest(computed, signature)Frequently Asked Questions: Square Webhooks
Why is Square webhook signature verification unique?
Square concatenates the exact Notification URL and the raw request body before applying HMAC-SHA256 and Base64 encoding.
Ready to test Square webhooks in real-time?
Get your free, private edge endpoint instantly. Zero signup, zero credit card, 100% free forever.