Signed event delivery you can build on.

# Register an endpoint that wants payment + dispute events only.
$ curl -X POST https://api.meraspay.io/v1/webhook_endpoints \
  -u sk_live_xxx: \
  -d url=https://ops.example.io/webhooks/meraspay \
  -d "enabled_events[]=payment_intent.*" \
  -d "enabled_events[]=dispute.*"

{
  "id": "wh_01HZF...",
  "url": "https://ops.example.io/webhooks/meraspay",
  "secret": "whsec_4yV2…",      # store this; will not be returned again
  "enabled_events": ["payment_intent.*", "dispute.*"]
}

// Verify a MerasPay webhook signature in Node.
import crypto from 'crypto';

export function verify(req, secret) {
  const header = req.headers['meraspay-signature'];
  const [tPart, sigPart] = header.split(',');
  const t = tPart.replace('t=', '');
  const sig = sigPart.replace('v1=', '');

  // Reject anything older than 5 minutes to block replay attacks.
  const age = Date.now() / 1000 - Number(t);
  if (age > 300) throw new Error('webhook: stale');

  const payload = `${t}.${JSON.parse(req.rawBody).id}.${req.rawBody}`;
  const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    throw new Error('webhook: signature mismatch');
  }
}