Verifying the ReturnURL and IPN Notifications

Amazon Simple Pay sends you outbound notifications for both the ReturnURL and IPN notification. For the ReturnURL, it is in the form of GET data, and for IPN notification, it is POST data. When you handle these notifications, we recommend you validate the signature to ensure the notification originated from Amazon Payments.

Signature version 2 security enables you to verify the signature of the response using a server-side call to the VerifySignature FPS Action. To use it, modify your returnUrl and ipnUrl pages to parse the notification. From those components, you assemble the relevant parameters for VerifySignature and sign it like any other request. The result of the call is either Success, meaning the response is valid, or Failure, indicating the response is suspect.

For more information on VerifySignature, see VerifySignature. In addition, you can use the validation samples to assist creating your own validation pages. For more information, see Understanding the IPNAndReturnURLValidation Sample.