How do I secure payment notification callbacks from Haitian mobile-money providers?

Treat every callback as an untrusted hint that something may have happened, never as proof.

The robust pattern: notify, then re-fetch.

app.post("/webhooks/:provider", async (req, res) => {
  const provider = providers[req.params.provider.toUpperCase()];
  if (!provider) return res.sendStatus(404);
 
  // Extract only an identifier from the body…
  const attemptId = extractAttemptId(provider.id, req.body);
  if (attemptId) {
    // …then ask the provider directly, server to server, what really happened.
    await confirmAttempt(attemptId);   // checks status + amount, idempotent
  }
  res.sendStatus(200);                 // acknowledge quickly; don't leak details
});

Because confirmAttempt verifies against the provider's API, a forged callback can at most trigger a harmless status check.

Add these when the provider supports them:

• Signature verification: if the provider signs callbacks (an HMAC header), verify it with a constant-time comparison before doing anything.
• Source IP allowlist, if the provider publishes stable addresses. It's a useful extra layer, never the only one.
• Rate-limit the endpoint. It shouldn't become a way to make your server hammer the provider's API.
• Respond fast and process asynchronously if confirmation is slow. Providers retry on timeouts, which is fine because your confirmation is idempotent.
• Log raw callbacks, with secrets and PINs redacted, for disputes and debugging.