documentverification/cashfree/webhooks_and_test_data.md

Cashfree Secure ID - Webhooks & Comprehensive Sandbox Test Data

---

Part 1: Webhook Integration & Security

Cashfree dispatches HTTP POST callbacks for async verification completion (BAV Async, Video KYC, DigiLocker, E-Sign, Reverse Penny Drop, KYC Links).

Webhook Event Header & Signature Verification

Every webhook notification includes security headers to prevent spoofing.

x-webhook-signature: <HMAC_SHA256_SIGNATURE>
x-webhook-timestamp: <UNIX_TIMESTAMP>

Verification Algorithm:

1. Extract raw request payload body string raw_body.
2. Extract timestamp value timestamp from x-webhook-timestamp header.
3. Form payload to sign: timestamp + "." + raw_body.
4. Calculate HMAC-SHA256 hash using your Cashfree Secret Key (x-client-secret).
5. Base64-encode the resulting digest.
6. Compare with incoming x-webhook-signature header string.

Code Example (Node.js):

const crypto = require('crypto');

function verifyCashfreeWebhook(rawBody, timestamp, signatureHeader, clientSecret) {
    const payloadToSign = timestamp + '.' + rawBody;
    const computedSignature = crypto
        .createHmac('sha256', clientSecret)
        .update(payloadToSign)
        .digest('base64');
    return computedSignature === signatureHeader;
}

---

Part 2: Complete Sandbox Test Data Reference

In the Test / Sandbox environment (https://sandbox.cashfree.com/verification), you MUST use the exact sample data below to simulate success and failure scenarios. Any unlisted values will be rejected.

1. General Test OTP

• Standard Verification OTP: 111000
• Video KYC Test OTP: 123456
• 1-Click Onboarding Test OTP: 1234 (Phone number: 9999991234)

---

2. Bank Account & Name Match Test Data

Account Number	IFSC Code	Expected Result / Remarks
026291800001191	YESB0000262	SUCCESS (Name: JOHN DOE)
00011020001772	HDFC0000001	SUCCESS
000890289871772	SCBL0036078	SUCCESS
1233943142	YESB0000262	SUCCESS (Name: TOM WELLS)
388108022658	YESB0000262	SUCCESS (Name: BOB HOPE)
000100289877623	SBIN0008752	FAILED_AT_BANK
2640101002729	CNRR0002640	INVALID_IFSC_CODE
026291800001190	YESB0000262	INVALID_ACCOUNT_NUMBER
02014457596969	CITI0000001	SUCCESS (Transitions later to REVERSED)

---

3. PAN Verification Test Data

PAN	Type	Remarks
ABCPV1234D	Individual	VALID
XYZPP4321W	Individual	VALID
AZJPG7110R	Individual	VALID
ABCCD8000T	Business	VALID
XYZHP2000L	Business	VALID
AAAHU4383C	Business	VALID
AMJCL2021N	Business	VALID
DEFPV0126D	Individual	INVALID
TUVPP5678W	Individual	INVALID
LMNCD8010T	Business	INVALID

---

4. Aadhaar Verification Test Data

Aadhaar Number	Remarks
655675523712	VALID
655675523711	VALID
655675523710	INVALID
655675523709	INVALID

---

5. GSTIN Verification Test Data

GSTIN	Remarks
29AAICP2912R1ZR	VALID
27ABCFGH5678D1Z	VALID
36JKLPQR9012E2Y	VALID
05BBICP2912R1ZR	VALID
29AAIZP2912R1ZR	INVALID
05BBICA2912R1ZR	INVALID

---

6. UPI Penny Drop Test Data (VPA)

VPA / UPI ID	Remarks
success@upi	VALID
valid@upi	VALID
valid@ybl	VALID
invalid@upi	INVALID
incorrect@upi	INVALID
expired@upi	EXPIRED

---

7. Officially Valid Documents (OVDs) Test Data

Driving Licence

• Valid: DL KA0120198900984 (DOB: 1994-08-05)
• Invalid: DL KA2320238908787 (DOB: 1987-09-04)

Voter ID (EPIC)

• Valid: UAI4574761
• Invalid: UAI4574762

Passport (File Number prefix)

• Valid: Prefix PA1 (e.g., PA1123456789012)
• Invalid: Prefix PA0

Vehicle RC (Registration Number)

• Valid: HJ01ME5678
• Invalid: HJ01ME5279

---

8. Corporate & MSME Verification Test Data

CIN (Corporate Identification Number)

• Valid: U72900KA2015PTC082989, U72900KA2015PTC082988
• Invalid: U72900KA2015PTC082981

Udyam Registration

• Valid: UDYAM-UP-43-1234567
• Not Found: UDYAM-MH-43-1234567
• Cancelled: UDYAM-KA-43-1234567

PAN to Udyam

• Success: PAN AMJCL2021N
• Not Found: PAN LMNCD8010T

---

9. Face Liveness Test Prefix

Verification ID Prefix	Simulated Result
2222XXXXX	MULTIPLE_FACES_DETECTED
3333XXXXX	FACE_NOT_DETECTED
4444XXXXX	REAL_FACE_NOT_DETECTED
Any other ID	SUCCESS / LIVE

---

10. Geocoding & IP Verification

• Geocoding Address: Bangalore Karnataka (VALID), AAA BBB CCC (INVALID)
• Reverse Geocoding Lat/Long: 12.9274915, 77.6326806 (SUCCESS)
• IP Address: 1.0.171.255 (VALID), 219.12.67.255 (INVALID)