# Webhook not working for live events even though test-event works in production environment

**URL:** <https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113>\
**Category:** Questions\
**Tags:** subscriptions-api, webhooks-api\
**Created:** [October 31, 2021, 9:10am UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113 "2021-10-31T09:10:33Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![ilikesinging](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/ilikesinging/32/873_2.png) [@ilikesinging](https://developer.squareup.com/forums/u/ilikesinging)\
**Post date:** [October 31, 2021, 9:10am UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/1 "2021-10-31T09:10:33Z")

</div>

Hi,  
I created a webhook external application to respond to the subscription.created event.  
The square application is in “production mode”.  
If I send a test event from the square production environment my external application is triggered and works as intended.  
However if a live new subscription is created my external application is NOT triggered.

So, it looks like the square webhook can correctly send test-events from the production environment but still is not active in real live.  
Please helpt to fix.

[edit], few hrs later…  
I did modify the receiver a bit to get logging also if signature hash fails.  
As result now also the test-event fails:

```auto
Error
Could not reach Square Connect test notification endpoint. Either Square Connect is not responding to messages, or you have lost connection to the internet.
2021-10-31 14:06:16

```

If I just hit the web hook receiver via chrome it functions fully ok (although in that case signature verification naturally fails)

application ID: sq0idp-lAzv\_Id6M6KZzY8hyHcXvw

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [November 1, 2021, 3:52pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/2 "2021-11-01T15:52:50Z")

</div>

👋 Looking at the logs I do see successful webhook deliveries. Also we recommend using the raw bytes from the request rather than converting the object representation in your language back to bytes for signature validation. 🙂

---

<div class="post-metadata">

**Author:** ![ilikesinging](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/ilikesinging/32/873_2.png) [@ilikesinging](https://developer.squareup.com/forums/u/ilikesinging)\
**Post date:** [November 1, 2021, 5:22pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/3 "2021-11-01T17:22:49Z")

</div>

Thanks,  
Ok,… at least the test events work again.  
I did just send 1st a test event and after that a live event (from doing an actual 1$ test buy).  
Indeed in both cases my Webhooks-receiver gets called.  
It always returns 200, no matter whether signature verification did pass or fail.

However:

- in case of test event the signature verification did pass
- in case of the real event the signature verification did fail.

“recommend using raw bytes”… can you explain a bit deeper?

I am using below php script (I did remove some privacy information)  
It works for test events, but apparently not for real events

Thanks

/\<?php  
$WebHookKey = ‘MY KEY’;  
$URLhandler = ‘MY SCRIPT.php’;  
$payload = file\_get\_contents(“php://input”);  
$stripped = preg\_replace(’/\s/’, ‘’, $payload);

$yourHash = hash\_hmac(‘sha1’, $URLhandler.$stripped, $WebHookKey);  
$HashBase64 = base64\_encode(hex2bin($yourHash));

$Signature = $\_SERVER[‘HTTP\_X\_SQUARE\_SIGNATURE’];

if (strcmp($Signature, $HashBase64) == 0)  
{  
echo ‘Webhook Success!!’;  
$message .= “\n\n Square signature OK”;  
} else  
{  
echo ‘Webhook Fail’;  
$message .= “\n\n Square signature FAIL”;  
}  
mail(‘MY EMAIL’, ‘[SQUARE message from subscription script]’, $message);  
http\_response\_code(200);  
?\>

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [November 1, 2021, 11:11pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/4 "2021-11-01T23:11:41Z")

</div>

Is the URL the fully-qualified URL? The URL handler should be the fully-qualified URL.

---

<div class="post-metadata">

**Author:** ![ilikesinging](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/ilikesinging/32/873_2.png) [@ilikesinging](https://developer.squareup.com/forums/u/ilikesinging)\
**Post date:** [November 2, 2021, 6:03am UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/5 "2021-11-02T06:03:40Z")

</div>

Hi Bryan,  
Thanks for the response.  
I don’t know what you mean with “fully qualified UFRL”. The URL points to a php script that is hosted on a subdomain of my website which is hosted by SiteGround.

Having said that, I find it difficult to believe it’s the url that makes the difference.  
Code has some reporting included that I left out in the before message for reading clarity.

But…

- When I send a test-event from the production environment of square (so not even the sandbox)  
 → code is executed  
 → When logging the $HashBase64 that I calculated I can see it to be equal to the signature square included in the message
- When I do an actual subscription using a checkout link using real creditcard with real money  
 → code is executed  
 → When logging the $HashBase64 that I calculated I can see it to be different from the signature square included in the message

[EDIT]  
Just updated the receiver:  
response 200: Signature validation SUCCEED  
response 202: Signature validation FAIL, but merchant\_id and message type SUCCEED (match expectation)  
response 299: Signature FAIL, merchant\_id and/or type FAIL

If your logging can read return payload → I included hash calculation results

Current behaviour:

- Send test event in production environment → signature validation succeeds, response 200
- Actual subscription purchase in production environment → signature validation fails but message content is ok, merchant\_id ok, type ok → response 202

So… issue remains… hash-calculation succeeds on test event but fails on real purchase

Any idea on how to proceed?

---

<div class="post-metadata">

**Author:** ![ilikesinging](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/ilikesinging/32/873_2.png) [@ilikesinging](https://developer.squareup.com/forums/u/ilikesinging)\
**Post date:** [November 4, 2021, 7:17pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/6 "2021-11-04T19:17:48Z")

</div>

Hi,  
Looks like I solved it.  
Instructions on [Verify and Validate an Event Notification](https://developer.squareup.com/docs/webhooks/step3validate) say:

> The value of this header is an HMAC-SHA1 signature generated using your webhook signature key, the notification URL, and the body of the request (excluding all whitespace).

However:

- Body already does not contain whitespace between fields
- But: Some content fields contain whitespace. In my case of subscription.created: the field “Square Online Store” and “Checkout Link” have whitespace.

Solution was simple: Since the body already does not have whitespace between the fields I removed the “remove whitespace” function and calculated the hash directly from the body.

I would say: error in instruction

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [November 4, 2021, 8:27pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/7 "2021-11-04T20:27:43Z")

</div>

I’ll be sure to pass this to the appropriate team. Thanks for sharing your findings! 🙂

---

<div class="post-metadata">

**Author:** ![magius](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/magius/32/916_2.png) [@magius](https://developer.squareup.com/forums/u/magius)\
**Post date:** [December 4, 2021, 12:03am UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/8 "2021-12-04T00:03:54Z")

</div>

Hello! I am having the same issue. I am now in the production mode of my app. When I send a test event for the order.fulfillment.updated event’s webhook, my server receives the POST request to the URL I assigned. Yay.

However, when an actual order.fulfillment.updated event occurs from a partnered seller, the server does not receive the POST request.

My other webhooks work totally fine with the partnered seller.

I’m not sure I understand how OP solved the issue. Is there a known solution?

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [December 4, 2021, 12:21am UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/9 "2021-12-04T00:21:26Z")

</div>

Do you have an `order_id` that you didn’t get the event?

---

<div class="post-metadata">

**Author:** ![magius](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/magius/32/916_2.png) [@magius](https://developer.squareup.com/forums/u/magius)\
**Post date:** [December 4, 2021, 12:27am UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/10 "2021-12-04T00:27:29Z")

</div>

sure, here is one of the many order\_id’s: w9d61lDWw8vLqNbBQzehrZOyQpRZY

EDIT:  
Ok, now the test events I am sending for this webhook aren’t being sent either. I get this error:

> Could not reach Square Connect test notification endpoint. Either Square Connect is not responding to messages, or you have lost connection to the internet.  
> 2021-12-03 18:32:22

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [December 6, 2021, 4:44pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/11 "2021-12-06T16:44:23Z")

</div>

I’m not seeing anything in the logs for webhooks with that order. What’s you applicationId?

---

<div class="post-metadata">

**Author:** ![magius](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/magius/32/916_2.png) [@magius](https://developer.squareup.com/forums/u/magius)\
**Post date:** [December 6, 2021, 6:14pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/12 "2021-12-06T18:14:37Z")

</div>

Sure, prod app ID is: sq0idp-n7Co30IXghyF\_BPiBvCnBA

UPDATE:  
Test events are working again. Actual events still are not.

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [December 6, 2021, 8:01pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/13 "2021-12-06T20:01:22Z")

</div>

Do you have a recent `order_id` that you aren’t getting the events for?

---

<div class="post-metadata">

**Author:** ![magius](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/magius/32/916_2.png) [@magius](https://developer.squareup.com/forums/u/magius)\
**Post date:** [December 6, 2021, 9:10pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/14 "2021-12-06T21:10:57Z")

</div>

I was troubleshooting and it begun to work once I added the permission: `ORDERS_READ ` for the account! Thank you Bryan!

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [December 6, 2021, 9:29pm UTC](https://developer.squareup.com/forums/t/webhook-not-working-for-live-events-even-though-test-event-works-in-production-environment/4113/15 "2021-12-06T21:29:24Z")

</div>

Ah, that will do it! 🙂