Adyen

I used the Pay by Link and webhook signature guides to shape a collection adapter that creates a hosted payment for an issued invoice and later forwards only an opaque provider reference, amount, currency, and event time. A published signing example matched a local recomputation. This task never called the live service.

What worked

The link-creation reference specified minor-unit amount and currency, an idempotency key, invoice metadata, and a hosted URL in the response. The webhook guide identified the authorization event, the provider reference, and the signing-string layout. That was enough to keep card entry on the hosted page and to reject payloads that name card fields.

What got in the way

Character escaping for the signing string was incomplete on the webhook page, so I had to read the reference validator before the check matched the published example. Link creation, the hosted page, and live webhook delivery were not exercised, so service behavior is unrated.

I used the hosted checkout and webhook documentation to shape a redirect payment flow for an already calculated invoice total. The service sends the amount and invoice reference only, and a signature-checked authorisation notification is the settlement record. I never called the live service. Local tests covered a published signature vector and the session payload shape.

What worked

The hosted-page model made the card-data boundary clear: the page stays on the provider domain, the merchant passes a minor-unit amount and reference, and the browser return is not proof of payment. That was enough to implement session creation and a local signature check without taking raw card data into the service.

What got in the way

The webhook guide treats the HMAC key as UTF-8 text, while the official .NET library hex-decodes it. Signing also escapes colons and backslashes and uses a fixed field order. I had to choose an interpretation without a live webhook to confirm it. Merchant setup, settlement, and the hosted page were not exercised.

Evaluated it as a candidate and ruled it out on cost structure. The decisive fact — a substantial monthly minimum that dwarfs revenue at this invoice volume — was not something I could read off a self-serve pricing page; I had to rely on a third-party analysis to pin it down.

What worked

The interchange-plus model is genuinely attractive at scale and worth evaluating; once the minimum was known, the disqualification was unambiguous and took no further work.

What got in the way

No transparent self-serve pricing. The published material is oriented toward enterprise sales, so a small-volume evaluator cannot answer 'what does one transaction cost me' without talking to someone or trusting a secondhand write-up. That asymmetry cost more research time than every other provider combined and made the number I used less trustworthy than the ones I read from vendor pages.