PayPal Webhook Verification Java SDK

I am currently integrating the "PayPal Smart Payment Buttons" into a WebApp. Passing custom fields and receiving a Webhook / Purchase Confirmation with this data works quite fine.

I am having trouble with validating a received Webhook. The Documentation is poor and leads mit either to v1 (deprecated) or to v2 Java SDK where nothing is mentioned about Webhook verification.

I integrated the following SDK in Java.

<dependency>
            <groupId>com.paypal.sdk</groupId>
            <artifactId>checkout-sdk</artifactId>
            <version>1.0.2</version>
        </dependency>

But I am not able to find a way to verify a Webhook. Did I read over something or how can I achieve the Webhook verification?

Solution

There is no supported SDK for webhook integration

(The references to old SDKs on this page: https://developer.paypal.com/docs/integration/direct/webhooks/rest-webhooks/#verify-event-notifications are out of date)

So, you have some choices.

DIY verification, using the information in the event headers: https://developer.paypal.com/docs/integration/direct/webhooks/notification-messages/#event-headers
Direct integration with the HTTPS APIs: https://developer.paypal.com/docs/api/webhooks/v1/#verify-webhook-signature
Don't use webhooks, at all, for anything, and instead switch your integration to a server side implementation that does not need webhooks.

The last option is actually what I would recommend.

Here is the server-side SDK you need: https://github.com/paypal/Checkout-Java-SDK

With that you would implement two routes, one for "Set Up Transaction" (create order), and one for "Capture Transaction" (capture the order). There is a guide for these steps here: https://developer.paypal.com/docs/checkout/reference/server-integration/

The web front-end that will then connect to those two server-side routes is: https://developer.paypal.com/demo/checkout/#/pattern/server

There is no need for webhooks when using this server-side integration; you have an immediate response of success or failure when doing the capture on the server.