Callback

Upon every successful transaction, a callback will be send to the link that you provided earlier through parameter

callback_url

However, LeanX callback mechanism will send an encoded JWT message instead of plain text to provided link, which need to be decoded with a hash key before it can be read. Below are the sample of callback response before and after encoding and decoding process.

Hash Key can be retrieved in your portal dashboard under API page.

Sample callback response before JWT decode

{
   "data":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbnZvaWNlX25vIjoiQlAxNzAxMTU1ODgwdUJNd0I5cTAiLCJjbGllbnRfZGF0YSI6eyJtZXJjaGFudF9pbnZvaWNlX25vIjoiTFhQQVlldWJiNjhXMTcwMTE1NTg0MnVOSGhTIiwidXVpZCI6IjhlZjRjZTUwLWFlYmItNGQ4Yy1iMTQyLTRmYTJhMDg5ZmQwNiIsIm9yZGVyX2lkIjoiTm9uZSJ9LCJpbnZvaWNlX3N0YXR1c19pZCI6MiwiaW52b2ljZV90eXBlX2lkIjoxLCJpbnZvaWNlX3R5cGUiOiJOT1JNQUxfQ09MTEVDVElPTiIsImludm9pY2Vfc3RhdHVzIjoiU1VDQ0VTUyIsImFtb3VudCI6IjQ1Ni4yMCIsInBheW1lbnRfbW9kZWxfcmVmZXJlbmNlX2lkIjoxLCJyYXRlX3R5cGVfcmVmZXJlbmNlX2lkIjoyLCJwYXltZW50X3NlcnZpY2VfaWQiOjg5LCJjbGllbnRfcmVkaXJlY3RfdXJsIjoiaHR0cHM6Ly93d3cueW91cmRvbWFpbi5jb20vcmV0dXJuLXBhZ2UiLCJjbGllbnRfY2FsbGJhY2tfdXJsIjoiaHR0cHM6Ly93d3cueW91cmRvbWFpbi5jb20vYXBpLWNhbGxiYWNrLXVybCIsImNsaWVudF90cmFuc2FjdGlvbl9kZXRhaWxzIjpudWxsLCJwcmVmdW5kX2NvbGxlY3Rpb24iOnsiaXRlbSI6bnVsbCwicmVzcG9uc2VfY29kZSI6MjEwMH0sImRlc2NyaXB0aW9uIjpudWxsLCJjYXJkX3Rva2VuIjpudWxsLCJmcHhfZGViaXRfYXV0aF9jb2RlIjoiMDAiLCJmcHhfY3JlZGl0X2F1dGhfY29kZSI6IjAwIiwiZnB4X2RlYml0X3N0YXR1cyI6IkFwcHJvdmVkIiwidHJhbnNhY3Rpb25fcmVzcG9uc2VfdGltZSI6IjI4IE5vdmVtYmVyIDIzIDAzOjE4OjAzIFBNIiwib3JpZ2luYWxfdHJhbnNhY3Rpb25fcmVzcG9uc2VfdGltZSI6IjIwMjMtMTEtMjggMTU6MTg6MDMiLCJhbGciOiJIUzI1NiJ9.sbYhLQgR6Y4MRlAyMaVPHNWOc3Bp9NvFyKOFF-npyIU",
   "response_code":2100
}

Sample callback response after JWT decode

{
  "invoice_no": "BP1701155880uBMwB9q0",
  "client_data": {
    "merchant_invoice_no": "LXPAYeubb68W1701155842uNHhS",
    "uuid": "8ef4ce50-aebb-4d8c-b142-4fa2a089fd06",
    "order_id": "None"
  },
  "invoice_status_id": 2,
  "invoice_type_id": 1,
  "invoice_type": "NORMAL_COLLECTION",
  "invoice_status": "SUCCESS",
  "amount": "456.20",
  "payment_model_reference_id": 1,
  "rate_type_reference_id": 2,
  "payment_service_id": 89,
  "client_redirect_url": "https://www.yourdomain.com/return-page",
  "client_callback_url": "https://www.yourdomain.com/api-callback-url",
  "client_transaction_details": null,
  "prefund_collection": {
    "item": null,
    "response_code": 2100
  },
  "description": null,
  "card_token": null,
  "fpx_debit_auth_code": "00",
  "fpx_credit_auth_code": "00",
  "fpx_debit_status": "Approved",
  "transaction_response_time": "28 November 23 03:18:03 PM",
  "original_transaction_response_time": "2023-11-28 15:18:03"
}

If you are integrating via your application, the hash key will always be an identifier or a signature to ensure that the callback was intended to be send to you. If the hash key is incorrect, it might be coming from unknown sources.