Mollie Webhooks Skill

When to Use This Skill

• Setting up a Mollie webhook handler (classic webhookUrl or next-gen subscription)
• Verifying the X-Mollie-Signature header on next-gen webhooks
• Understanding why classic Mollie webhooks have no signature to verify
• How do I confirm a Mollie payment status from a classic webhook?
• Handling payment status changes: paid, authorized, canceled, expired, failed
• Why does my Mollie webhook only contain an id?

Two Webhook Systems (Read This First)

Mollie runs two webhook systems side by side. They are secured differently, so work out which one you are receiving before writing a handler.

Mollie's guidance: "If your system needs to support both webhook styles, differentiate between payments webhooks webcalls and new calls (new Webhooks send a new header X-Mollie-Signature...)", and "we recommend using separate URLs (one for each webhooks system)". The examples use /webhooks/mollie for classic and /webhooks/mollie/events for next-gen.

Classic Webhooks: Fetch to Confirm

Classic webhooks are not signed: no HMAC, no signature header, no shared secret. Mollie sends a POST with a single application/x-www-form-urlencoded body parameter:

id=tr_5B8cwPMGnU6qLbRvo7qEZo

The status is deliberately not in the payload. You must not trust the request body: anyone could POST a fake id. Instead you fetch the resource from the Mollie API using your API key and read the authoritative status. This is the fetch-to-confirm pattern, and it is the security model: a forged webhook can only ever cause you to re-fetch a real payment you own.

Mollie ──POST id=tr_xxx──▶  your endpoint
                              │
                              ▼
                    GET /v2/payments/tr_xxx  (with your API key)
                              │
                              ▼
                    read payment.status → act → return 200

Authenticate with your API key as a Bearer token (test_… or live_…). Always return 200 quickly (even for an unknown or deleted id) so Mollie stops retrying.

Node (official SDK, @mollie/api-client):

const { createMollieClient } = require('@mollie/api-client');
const mollie = createMollieClient({ apiKey: process.env.MOLLIE_API_KEY });

// req.body.id came from the x-www-form-urlencoded webhook — do NOT trust it as status.
const payment = await mollie.payments.get(req.body.id); // 404 => unknown id, ack with 200
switch (payment.status) {                               // authoritative status from the API
  case 'paid': /* fulfill order */ break;
  case 'expired': case 'failed': case 'canceled': /* release order */ break;
}

Python (manual fetch with the REST API):

async with httpx.AsyncClient() as client:
    r = await client.get(
        f"https://api.mollie.com/v2/payments/{payment_id}",
        headers={"Authorization": f"Bearer {os.environ['MOLLIE_API_KEY']}"},
    )
# r.status_code == 404 => unknown id, acknowledge with 200
payment = r.json()          # authoritative status from the API
status = payment["status"]  # 'paid' | 'authorized' | 'canceled' | 'expired' | 'failed' | ...

Next-gen Webhooks: Verify X-Mollie-Signature

Each next-gen delivery carries X-Mollie-Signature: sha256=<hex>, an HMAC-SHA256 of the unaltered request body keyed with the webhook's signing secret. To verify: strip the sha256= prefix, compute the HMAC over the raw body, and compare with a timing-safe function. Parse the JSON only after the signature checks out.

When you rotate the secret, Mollie sends two X-Mollie-Signature headers for 24 hours (one per secret). Node and the Fetch API join repeated headers into one comma-separated string, so split on , and accept the request if any value matches.

const crypto = require('crypto');

function verifyMollieSignature(rawBody, signatureHeader, secret) {
  if (!signatureHeader || !secret) return false;
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return signatureHeader.split(',').some((value) => {
    const provided = value.trim().replace(/^sha256=/, '');
    const a = Buffer.from(provided);
    const b = Buffer.from(expected);
    return a.length === b.length && crypto.timingSafeEqual(a, b);
  });
}

// Express: express.raw({ type: '*/*' }) so req.body is the raw Buffer
if (!verifyMollieSignature(req.body, req.headers['x-mollie-signature'], process.env.MOLLIE_WEBHOOK_SECRET)) {
  return res.status(400).send('Invalid signature');
}
const event = JSON.parse(req.body);   // { resource: 'event', id, type, entityId, createdAt, ... }

import hashlib, hmac

def verify_mollie_signature(raw_body: bytes, signature_headers: list[str], secret: str) -> bool:
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    for header in signature_headers:              # request.headers.getlist("x-mollie-signature")
        for value in header.split(","):
            provided = value.strip().removeprefix("sha256=")
            if hmac.compare_digest(provided.encode(), expected.encode()):
                return True
    return False

Mollie's TypeScript SDK (mollie-api-typescript) ships a SignatureValidator that implements the same steps. Mollie's docs disagree on where the signing secret comes from (the guide says you provide it; the Create webhook API returns it as webhookSecret), so take it from wherever your webhook setup shows it.

For complete handlers with route wiring, status dispatch, and tests, see:

• examples/express/
• examples/nextjs/
• examples/fastapi/

Common Payment Statuses (classic)

The classic webhook fires whenever a payment's status changes. Fetch the payment to read which status it now has:

The webhook id prefix tells you the resource type: tr_ = payment. Refunds and chargebacks reuse the payment's webhook, so re-fetch the payment (and its refunds) on any call.

For the full status reference, see Mollie payment status changes.

Common Event Types (next-gen)

Next-gen events are identified by the top-level type; entityId is the affected object. Mollie lists these as global events, "publicly available and supported across all accounts":

Refund, chargeback, capture, dispute, file and unmatched-credit-transfer events are listed as beta (request access from Mollie support). Subscribe with eventTypes, or * for all. The same Mollie page still recommends classic webhooks for payment updates in its classic section; see references/overview.md.

For the full list, see Next-gen webhooks: Event types.

Environment Variables

MOLLIE_API_KEY=test_xxxxx            # Classic: API key (test_… or live_…) used to fetch payments
MOLLIE_WEBHOOK_SECRET=your_secret    # Next-gen: the webhook subscription's signing secret

Classic webhooks need only the API key (the same key creates payments with a webhookUrl and fetches them in the handler). Next-gen webhooks need the subscription's signing secret.

Local Development

# Start tunnels (no account needed) — forward to your local handlers
npx hookdeck-cli listen 3000 mollie --path /webhooks/mollie                # classic
npx hookdeck-cli listen 3000 mollie-events --path /webhooks/mollie/events  # next-gen

Classic: set the first public URL as the webhookUrl when you create a payment (classic webhooks are configured per payment via the API, not in the Dashboard). Next-gen: use the second URL for a test-mode webhook subscription (Dashboard Developers → Webhooks, or POST /v2/webhooks with testmode: true).

Reference Materials

• references/overview.md - Classic vs next-gen webhooks, statuses and event types
• references/setup.md - API key and webhookUrl (classic); subscriptions and signing secret (next-gen)
• references/verification.md - Fetch-to-confirm (classic) and signature verification (next-gen) in detail