During implementation, the team found that there is a notification controller exposed for an external service that marks the order as paid when…

To enhance the security of the notification controller exposed for marking orders as paid, the recommended approach is to add an order-specific token to the callback URL (Answer C). This token should be verified against a stored value on the order to ensure the authenticity and integrity of the payment notification. This method prevents unauthorized use of the controller, as only callbacks containing the correct, order-specific token would be allowed to mark orders as paid. This strategy is essential in maintaining secure and reliable transaction processes within Salesforce B2C Commerce.