Deliver from your own server (dynamic products)

Dynamic (webhook) products are for sellers whose own system creates the item: a key generated by your licensing server, an account created through an API, a top-up applied in your game.

How it works

1. A buyer pays.
2. SellPass sends the order to your delivery endpoint as JSON in a POST request.
3. Your server does its work and replies with the text to deliver.
4. We show that reply to the buyer and email it to them.

Set it up

1. Create a product with type Dynamic (webhook).
2. Enter Your delivery endpoint, for example https://api.yoursite.com/deliver.
3. Copy the Signing secret. Tick Regenerate on save if you ever need a new one.
4. Save, then place a test order.

Verify the request

Every request carries an X-Signature header: the HMAC-SHA512 of the raw request body, using your signing secret. Compute the same value on your server and reject the request if it doesn't match.

$expected = hash_hmac('sha512', file_get_contents('php://input'), $secret);
if (! hash_equals($expected, $_SERVER['HTTP_X_SIGNATURE'] ?? '')) {
    http_response_code(401); exit;
}

Limits

• Your server must answer within 10 seconds.
• The reply can be up to 64 KB.
• The URL must be a public address (not localhost or a private network).

If your server fails, the order waits for delivery and you can deliver it by hand from the order page. Full payload details are in the developer docs.