# Cart payment completed (/api/webhooks/cart-payment-completed)

Webhook event `cart:payment_completed`, sent as `POST` to your subscription's URL.

Fires when the completed payments on the order made from a cart cover its total and no payment on it is `pending`, at the same time as `order:payment_completed`. A cart paid by an authorization that is captured later fires it at capture. The body is an event object with the cart in `data`.

## Parameters

- `X-Comecero-Signature` (header): Proof the delivery comes from Comecero and was not changed. It is the HMAC-SHA256 of the raw request body (UTF-8), keyed with the signature key as UTF-8, written as 64 lowercase hex characters. The key is the event subscription's `signature_key`, or the account's signature key (Settings, Technical) when the subscription has none. Every account gets one when it is created, so deliveries are signed unless the key was removed. To check it, compute the HMAC over the body exactly as received, before you parse it, and compare the two strings in constant time. Reject the delivery when they differ. The signature has no timestamp, so to guard against a replayed delivery also skip any `event_id` you already handled. If you cannot check signatures, use the event only as a hint: get the object by its id from the API before you act on it.
- `User-Agent` (header): Always `Comecero-Event (+https://comecero.com)`.

Responses: 200.

Full schemas: operation `event_cart_payment_completed` in /openapi.json.