HMAC-signed. Status is recorded by
callback.php or
return.php — whichever verifies first.
PHP demo — payment integration in vanilla PHP
callback.php or
return.php — whichever verifies first.