---
title: "Lava Webhook"
method: POST
path: "/api/v1/payment/lava/callback"
tags: ["payment"]
---

# Lava Webhook

`POST /api/v1/payment/lava/callback`

lava.top webhook — credential verified in the decorator.

Credits balance_usd for RUB-session recharges (payment.success). lava's
webhook carries no signature (static header credential only), so before
crediting we RE-FETCH the invoice from lava's own API and require
status=COMPLETED — a forged webhook cannot make lava's API say that. The
rest is the standard acquirer contract: row-lock + status idempotency,
DB-amount-of-truth (we credit order.amount USD, never a webhook figure),
amount/currency reconciliation against orders.amount_rub.

URL has NO trailing slash on purpose: LanguageMiddleware 301s any
trailing-slash path, which would break lava's POST delivery.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/qcode/apis/qcode-web.md) · [All operations](https://skmtc.dev/qcode/apis/qcode-web/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/qcode/qcode-web/revisions/2f2f5f49ffc7/schema)