eBay account deletion webhook on Azure Functions (.NET/C#)

The Marketplace Account Deletion endpoint is mandatory to obtain the eBay production keyset. The full developer setup guide shows the flow with an AWS Lambda example; here we cover the .NET/C# on Azure Functions variant, for those already on Azure.

What the endpoint must do

Two responsibilities on a single HTTPS URL. On GET, eBay sends a challenge_code and expects the SHA-256 hash of challenge_code + verification_token + endpoint, in JSON. On POST, deletion notifications arrive: you validate the signature and delete/anonymise the user's data.

The C# example on Azure Functions

[Function("ebayAccountDeletion")]
public async Task<HttpResponseData> Run(
    [HttpTrigger(AuthorizationLevel.Anonymous, "get", "post")] HttpRequestData req)
{
    // 1) GET = challenge verification
    var challenge = HttpUtility.ParseQueryString(req.Url.Query)["challenge_code"];
    if (challenge is not null)
    {
        var token = Environment.GetEnvironmentVariable("EBAY_VERIFICATION_TOKEN");
        var endpoint = "https://app.example.com/api/ebayAccountDeletion";
        var bytes = Encoding.UTF8.GetBytes(challenge + token + endpoint);
        var hash = Convert.ToHexString(SHA256.HashData(bytes)).ToLowerInvariant();
        var ok = req.CreateResponse(HttpStatusCode.OK);
        await ok.WriteAsJsonAsync(new { challengeResponse = hash });
        return ok;
    }
    // 2) POST = deletion notification: validate the signature, then delete data
    return req.CreateResponse(HttpStatusCode.OK);
}

The challenge response must have Content-Type: application/json and contain exactly the challengeResponse field. Expose the endpoint over HTTPS with a stable URL.

Configuration: token and secrets

The verification token and credentials must not be hardcoded: keep them in app settings or, better, in a secret manager with a managed identity, as described in the guide on securing secrets and credentials with Azure Key Vault. The same applies to the OAuth tokens for the eBay Sell API.

Validating the POST notification

POST notifications must be authenticated by verifying the signature eBay provides (signature header and the sender's public key) before acting. Respond quickly with 200/204 and perform the deletion asynchronously, so you don't time out or lose notifications.

Deploy and configuration in the portal

• publish the Function on a stable HTTPS domain;
• enter the URL and verification token in the eBay portal and complete the challenge validation;
• verify the GET returns the correct hash before going to production.

Common mistakes

• concatenating the three values in the wrong order or with spaces: the hash won't match;
• returning the hash as text instead of in JSON with challengeResponse;
• processing the deletion synchronously and timing out;
• hardcoded tokens and secrets in the code.

Conclusion

The Azure Functions variant in C# is compact: handle challenge and notification in the same HTTP trigger, validate the signature and keep secrets out of the code. For the full developer setup flow, refer to the main guide. References: Azure Functions documentation and eBay Developers Program.