---
title: "Confirm payments on the server · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/confirm-payment-server-side
updated: 2026-10-20
licence: "All rights reserved"
---

# Confirm payments on the server

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)
- Rule: Mark an order as paid only after the payment provider confirms it through a signed webhook or its API. Never trust the return to your success page.
- How: Anyone can open the success address without paying. Verify the webhook's signature with the provider's library, using the raw request body. Check the amount and currency against the order, and handle each event ID once. Show "payment pending" until the webhook arrives. See also [let provider events move the order](https://agentwranglers.se/playbook/payments/payment-events-and-reconciliation/events-drive-fulfilment).
- Check: Open the success address of an unpaid test order directly. The order stays unpaid. Send a webhook with a wrong signature. It is refused and nothing changes.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/confirm-payment-server-side`.

- Previous: [Protect free tiers from automated abuse](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/free-tier-abuse)
- [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)