Netcash Pay Now notifications are not signed: how to verify them

Why you cannot trust the callback alone

The Notify request is a plain form post. Anyone who learns your Notify URL can post TransactionAccepted=true to it. Checking a shared secret is not possible because there is none in the payload, so the only trustworthy source is Netcash itself.

Ask Netcash

const res = await fetch(
  `https://ws.netcash.co.za/PayNow/TransactionStatus/Check?RequestTrace=${encodeURIComponent(trace)}`,
  { cache: "no-store" },
);
const j = await res.json();
const accepted = j.TransactionAccepted === true || String(j.TransactionAccepted).toLowerCase() === "true";
const cents = Math.round(Number(j.Amount) * 100);
// credit only if accepted, j.Reference is yours, and cents equals the order total

If Netcash cannot be reached, return an error so Netcash retries later. Never credit on a failed check.

Make crediting safe to repeat

Netcash retries notifications until it gets a response, so the same payment can arrive more than once. Key your payment record on your own reference and make the credit step a no-op when that record is already paid.

Cash-at-a-shop and EFT payments notify later than card payments, sometimes the next business day. Show the customer a pending state rather than a failure when they return before the money does.

Read next

how to accept netcash pay now payments in next.js, and card option missing on netcash pay now? check the r100 limit. Or browse every guide.