← Back to your dashboard

Airwallex instant confirmation

This is about the webhook secret for your Airwallex connection. It isn't an error, and nothing is broken — it just controls how fast a payment is confirmed.

On this page

What the notice means

Two things connect Airwallex to GoCushy:

  1. Your API keys — let GoCushy take payments on your Airwallex account. (You've done this. Which permissions they need →)
  2. A webhook secret — lets Airwallex tell GoCushy back, instantly and securely, that a payment succeeded.

Without the webhook secret, payments still go through and orders are still confirmed — GoCushy just finds out via a backup check that runs every 5 minutes rather than the instant the payment clears. So a buyer might briefly see "pending" before it flips to paid. It's a speed difference, never a lost payment.

The webhook is a shortcut, not the payment pathA payment intent has already succeeded for NZ$49.00 in the merchant's own Airwallex account. Two lanes lead away from it. With a webhook secret saved, Airwallex posts to the per-connection endpoint and the event passes four checks — signature, timestamp age, event id, amount and currency — and the order is confirmed in seconds. With no secret the endpoint returns 404 and nothing unsigned is trusted, so gocushy:reconcile asks Airwallex for the intent directly every five minutes. Both lanes end in the same call, fulfillPaid. The webhook is a shortcut, not the payment path Money settles in your Airwallex before either lane runs. The secret only decides how fast GoCushy hears about it. THE PAYMENT — BEFORE EITHER LANE RUNS int_hkdmT9a2c1x · SUCCEEDED NZ$49.00 · The Joinery Course The charge already cleared in Fernwood & Co.’s own Airwallex account. Neither lane below moves the money. They only decide when GoCushy finds out. LANE A — WEBHOOK SECRET SAVED POST /airwallex/webhook/{connection} headers: x-timestamp · x-signature ✓ HMAC-SHA256 over timestamp + body matches ✓ the timestamp is within 300 seconds ✓ this event id has not been processed ✓ amount + currency match what was charged Confirmed the moment the charge clears. a signature that does not match → 400, ignored LANE B — NO SECRET SAVED POST /airwallex/webhook/… → 404 No secret saved, so nothing unsigned is trusted. gocushy:reconcile · every 5 minutes ✓ asks Airwallex for the intent directly ✓ status SUCCEEDED, amount + currency match ✓ only orders older than 5 minutes Confirmed on the next sweep that sees it. Manage shows: Instant settlement · not configured BOTH LANES END IN THE SAME CALL orders.status = paid → fulfillPaid() Receipt, order.paid webhook, affiliate commission, your sale notification — one code path. Same result A missing secret costs you minutes, never money — the payment cleared before either lane ran. The signature is what stops a forged “payment succeeded” — which is why it must be the exact secret Airwallex gives you.
The payment has already cleared in Fernwood & Co.'s own Airwallex account before either lane runs, so nothing below moves money — only news. With a webhook secret saved, Airwallex posts to that connection's own endpoint and GoCushy trusts the event only after four checks: an HMAC-SHA256 digest over the timestamp plus the raw body, a timestamp no more than 300 seconds old, an event id it has not already processed, and an amount and currency matching what the buyer was charged. The order then flips to paid the moment the charge clears, and a signature that does not match is answered with 400 and ignored. With no secret saved the endpoint answers 404, because nothing unsigned is trusted; instead gocushy:reconcile runs every five minutes, asks Airwallex for the payment intent directly, and marks the order paid when that intent reads SUCCEEDED for the same amount and currency — skipping orders younger than five minutes so a webhook that is about to arrive wins first. Both lanes end in the same call: orders.status becomes paid and fulfillPaid() sends the receipt, fires your order.paid webhook, accrues the affiliate commission and posts your sale notification. The secret decides how long the buyer waits, never whether you get paid.
Your money is never at risk either way. Payments settle in your own Airwallex account, and GoCushy's reconcile check catches anything a missed webhook would have. The webhook secret just removes the wait.

How to add it (about 2 minutes)

  1. In your GoCushy dashboard, open Getting paid → Airwallex → Manage and copy your webhook URL (it looks like https://…/airwallex/webhook/…).
  2. In your Airwallex dashboard, go to Developer → Webhooks → Add webhook.
  3. Paste your webhook URL, then tick these events. They sit under the Payment Intent, Refund and Dispute groups — tick the individual leaf events, not the group headers:
    • payment_intent.succeeded — instant payment confirmation
    • refund.succeeded and refund.failed — keeps refunds honest in both directions
    • dispute.pre_chargeback_received_by_merchant — the earliest warning, and the only stage where you can still refund and avoid the chargeback
    • dispute.dispute_received_by_merchant — an actual chargeback landed
    • dispute.rfi_received_by_merchant — a request for information (optional; low volume)
    • dispute.won and dispute.lost — the outcome

    Airwallex only delivers the events you tick. With just the first one, payments confirm instantly but a refund you issue from Airwallex never reaches GoCushy — the order stays paid and the buyer keeps access — and a chargeback arrives with no alert and no deadline warning.
  4. Airwallex shows a signing secret for that webhook — copy it.
  5. Back in GoCushy's Manage dialog, paste it into Webhook secret and press Save secret. The notice disappears and confirmations become instant.

Use the environment that matches your keys — a demo connection needs a webhook created in the Airwallex demo dashboard; a live connection needs a live one.

Why GoCushy verifies it

The secret lets GoCushy check that each "payment succeeded" message genuinely came from Airwallex (a signature match) before acting on it — so nobody can fake a paid order. That's why it must be the exact secret Airwallex gives you.

← Back to Getting paid