# Fixed: Urgent: I need to make delivery today and I am stuck with the payments API webhooks

**URL:** <https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926>\
**Category:** Questions\
**Tags:** checkout-api, webhooks-api, web-payments-sdk, payments-api\
**Created:** [July 5, 2023, 10:29am UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926 "2023-07-05T10:29:30Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![omkhan95](https://avatars.discourse-cdn.com/v4/letter/o/ecb155/32.png) [@omkhan95](https://developer.squareup.com/forums/u/omkhan95)\
**Post date:** [July 5, 2023, 10:29am UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926/1 "2023-07-05T10:29:30Z")

</div>

> **Fixed the issue by sending user\_id in payment note. 😅**

I have integrated checkout API in my laravel app and now i am trying to utilize webhook → payment.updated so then i can update the subscripton status of the user who made payment but i cannot access the Auth::user() i.e. the authenticated user on my app.

I have also verified the signature key for the webhook subscriptions.

> class SquareWebhookAuthentication  
> {  
> private const NOTIFICATION\_URL = ‘https://\*\*\*\*\*\*\*\*/payment-plan-webhook’; // Replace with your actual webhook URL  
> private const SIGNATURE\_KEY = ‘\*\*\*\*\*\*\*\*\*\*\*\*\*’; // Replace with your actual signature key
> 
> ```
> /**
> * Handle an incoming request.
> *
> * @param \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next
> */
> public function handle($request, Closure $next)
> {
> $receivedSignature = $request->header('x-square-hmacsha256-signature');
> $body = $request->getContent();
> 
> // Log::info("user id = ".config('user_id'));
> 
> // Perform your authentication logic here
> if (!$this->isFromSquare($receivedSignature, $body)) {
> return response('Unauthorized', 401);
> } else {
> // if(\Auth::check()) {
> // Log::info("Check = ".\Auth::user());
> // } else {
> // Log::info("User = ".\Auth::user());
> // }
> }
> 
> return $next($request);
> }
> 
> private function isFromSquare($signature, $body)
> {
> $hash = hash_hmac('sha256', self::NOTIFICATION_URL.$body, self::SIGNATURE_KEY, true);
> $expectedSignature = base64_encode($hash);
> return $signature === $expectedSignature;
> }
> 
> ```
> 
> }  
> I have tried almost everything. I think the problem is with presistent sessions or with the sanctum authentication.

I have also excluded the webhook route from my CSRFToken verification.

> class VerifyCsrfToken extends Middleware  
> {  
> /\*\*  
> \* The URIs that should be excluded from CSRF verification.  
> \*  
> \* @var array\<int, string\>  
> \*/  
> protected $except = [  
> ‘payment-plan-webhook’  
> ];  
> }

This is the error I get in my log.

> [2023-07-05 09:50:55] local.ERROR: Attempt to assign property “subscription\_status” on null {“exception”:"[object] (Error(code: 0): Attempt to assign property "subscription\_status" on null at /home/c2cdox/public\_html/app/Http/Controllers/PaymentController.php:43)

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [July 5, 2023, 7:06pm UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926/2 "2023-07-05T19:06:46Z")

</div>

Were you able to fix this by sending the user\_id in the payment note? If not what’s your application ID? 🙂

---

<div class="post-metadata">

**Author:** ![omkhan95](https://avatars.discourse-cdn.com/v4/letter/o/ecb155/32.png) [@omkhan95](https://developer.squareup.com/forums/u/omkhan95)\
**Post date:** [August 14, 2023, 3:44pm UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926/3 "2023-08-14T15:44:39Z")

</div>

sending user id in payment note only helps in sandbox envirenoment not production. But I made a way out for this. now thw problem is that i am recieving 2 webhook requests instead of one for my payment.updated webhook. i need to know why this is happening.

Application ID: sq0idp-8Xr9NugYJu1nlJP9PYQ\_rg

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [August 14, 2023, 6:26pm UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926/4 "2023-08-14T18:26:33Z")

</div>

Multiple `payment.updated` events isn’t unexpected. There are things like fees and customers added to payments asynchronously that trigger events. 🙂

---

<div class="post-metadata">

**Author:** ![omkhan95](https://avatars.discourse-cdn.com/v4/letter/o/ecb155/32.png) [@omkhan95](https://developer.squareup.com/forums/u/omkhan95)\
**Post date:** [August 15, 2023, 11:45am UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926/5 "2023-08-15T11:45:50Z")

</div>

Is there any solution to only get the request for when the payment is made. I need to keep the records for the payments for my customers.

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [August 15, 2023, 4:45pm UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926/6 "2023-08-15T16:45:39Z")

</div>

Yeah, you can listen to `payment.created` events which will trigger when a payment is made instead of getting multiple `payment.updated` events. 🙂

---

<div class="post-metadata">

**Author:** ![omkhan95](https://avatars.discourse-cdn.com/v4/letter/o/ecb155/32.png) [@omkhan95](https://developer.squareup.com/forums/u/omkhan95)\
**Post date:** [August 17, 2023, 11:11am UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926/7 "2023-08-17T11:11:27Z")

</div>

But doesn’t the checkout link only triggers the payment.updated event?

---

<div class="post-metadata">

**Author:** ![omkhan95](https://avatars.discourse-cdn.com/v4/letter/o/ecb155/32.png) [@omkhan95](https://developer.squareup.com/forums/u/omkhan95)\
**Post date:** [August 17, 2023, 11:16am UTC](https://developer.squareup.com/forums/t/fixed-urgent-i-need-to-make-delivery-today-and-i-am-stuck-with-the-payments-api-webhooks/9926/8 "2023-08-17T11:16:54Z")

</div>

thanks alot, Bryan. everything working now.