I am integrating PayPal subscriptions in a Django project. I have it working well but I'm thinking it could be possible that someone malicious can simulate a webhook call and get a free subscription. Currently I have no way to verify if the webhook really comes from PayPal.
In other payment systems I could set a secret word in the call (from the service provider) and then in the app server validate the call through the secret word.
There are several possible ways...
Post it back to PayPal, https://developer.paypal.com/docs/api/webhooks/v1/#verify-webhook-signature
Check the cryptographic signature, https://developer.paypal.com/docs/api-basics/notifications/webhooks/notification-messages/
Include a custom_id in the original transaction, which will be returned, https://developer.paypal.com/docs/api/orders/v2/#definition-purchase_unit_request
Just don't use one of the PayPal-*-SDKs, since they are deprecated.
