Verify purchase notifications

With the URL integration, DPD POSTs the details of each purchase to a URL on your site. Anyone can POST to that URL, so before you act on a notification (say, by creating an account), check that DPD sent it.

Send every parameter you received back to the API, unchanged, including verify_sign. With curl, that’s one --data-urlencode for each parameter (only two are shown here):

curl -u YOUR_USERNAME https://api.getdpd.com/v2/notification/verify \
  --data-urlencode "verify_sign=THE_SIGNATURE" \
  --data-urlencode "buyer_email=customer@example.com"

The answer is plain text, either VERIFIED or INVALID.

In PHP, forwarding the whole POST looks like this:

$ch = curl_init('https://api.getdpd.com/v2/notification/verify');
curl_setopt_array($ch, [
    CURLOPT_USERPWD => 'YOUR_USERNAME:' . getenv('DPD_API_PASSWORD'),
    CURLOPT_POSTFIELDS => http_build_query($_POST),
    CURLOPT_RETURNTRANSFER => true,
]);
$verified = curl_exec($ch) === 'VERIFIED';