Needachef
Dual payment flows and referral attribution for an embeddable hospitality booking system
What I did
The problem
An embeddable booking widget needed to handle payments and referrals correctly across partner contexts, with no tolerance for price-tampering or payment/booking-state drift.
The solution
Server-side price validation ensures amounts are always sourced from the database. Signed webhooks with HMAC SHA-512 handle Paystack callbacks. A reconciliation endpoint compares booking state against Paystack's record of truth.
Key features
- Dual Paystack checkout (shop orders + service bookings)
- Server-side price validation (closed client-trust vulnerability)
- HMAC SHA-512 webhook signature verification
- Payment/booking reconciliation endpoint
- Referral attribution tracking
Engineering decisions
Client-supplied prices could be tampered with
Moved price calculation entirely server-side; the widget only sends product/booking IDs
Eliminated the price-tampering vulnerability.
Technology stack
Impact
Lessons learned
Never trust the client with financial data. Any time a price crosses a network boundary, it must be validated server-side against a source of truth.
Ready to build something exceptional?
Let's discuss how custom software can accelerate your business outcomes.