WeChat Pay APIv3 rewrote the signing algorithm, the certificate model, and callback encryption all at once, so patterns carried over from v2 fail reliably. This walkthrough follows the real integration order: what each of the three key materials does, how to compute a request signature, how to verify and decrypt callbacks, which of the four payment products to pick, and how to build the order state machine and idempotency.
The order number looks like the simplest field in a payment system and is actually its foundation. Choose the generation strategy badly and the failures surface six months later: colliding numbers, values rejected as too long after switching channels, auto-increment IDs leaking real volume, and the same payment processed twice under concurrency. This article gives implementable designs.
Write one callback endpoint for the first channel and it is thirty lines. Copy it for the second. By the third the code has spiraled: verification logic scattered, response formats diverging, idempotency reimplemented three ways, and lost notifications untraceable. This article lays out a reusable framework with a unified entry point, verify adapters, an idempotency middle layer, and scheduled query compensation.
Every layer of a payment stack has to answer build or buy. Most teams weigh engineering months against subscription fees and only discover during an incident that responsibility was never clearly assigned. This article gives three decision questions, a layer-by-layer verdict, three common mistakes in building, and the four things you must keep in-house no matter how much you outsource.
A webhook integration guide based on webhooks.fyi plus the official Stripe and GitHub documentation, covering event models, signature verification, automatic retries, idempotent deduplication, and security best practices.