School Fee Payments

School Webhooks

Schools can register a webhook URL from their school portal to get notified the moment a fee payment lands, instead of polling the payments list.

Payload

Slimpay sends a POST request with a JSON body when a payment is confirmed:

json

{
  "event": "payment.received",
  "checkout_reference": "SCH-8F2A1C90",
  "invoice_id": "INV-2026-0042",
  "student_name": "Chidi Eze",
  "student_id": "STU-0042",
  "student_class": "JSS 2",
  "student_verified": true,
  "amount": 45000,
  "school_net": 44325,
  "platform_fee": 675,
  "timestamp": "2026-08-15T10:32:00+01:00"
}

Verifying the signature

Every request includes an X-Slimpay-Signature header — an HMAC-SHA256 hash of the raw request body, signed with your school's webhook secret (visible in your school portal settings). Verify it before trusting the payload:

php

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_SLIMPAY_SIGNATURE'] ?? '';
$expected = hash_hmac('sha256', $payload, $yourWebhookSecret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

Always verify

Never act on a webhook payload without checking the signature first — treat an unverified webhook exactly like an unauthenticated POST from the public internet, because that's what it is until you've confirmed the signature.

Retries & replay protection

Failed deliveries (non-2xx response, or timeout) are retried with backoff. Deliveries are logged in your school portal's Webhooks tab, where you can also resend any individual delivery manually and send a test payload.

← Previous

Overview