Hi everyone,
I’m struggling to get Square webhooks to reach my endpoint. When I send test events like “payment.created” from the Developer Dashboard, Square immediately returns 403 Forbidden and I never see any incoming request in my server logs.
What I’ve verified so far:
• My webhook URL is correctly registered in the Dashboard (including trailing slash).
• A manual curl -X POST to that same URL (with an empty JSON body) returns 200 OK every time.
• I’m tunneling my local server through Cloudflare and the tunnel is active.
• I’m using the exact signature key from my webhook subscription and validating with the official is_valid_webhook_event_signature helper.
• I’ve disabled all authentication, CSRF, and firewall rules on that path to rule out middleware blocking.
Even with logging at the very top of my handler (before signature checks), I see nothing when I send a test event. It’s as if Square never even attempts the delivery.
Has anyone else encountered this behavior when using tunnels or local development environments? Are there any known quirks, extra headers, or Dashboard settings I might be missing? Any pointers would be greatly appreciated—thanks in advance!
3 posts - 2 participants