Question

Is there a way to detect a callback request is from facebook or not as it seems like the request is not ajax.

Answer 1

From: http://developers.facebook.com/docs/credits/callback/

You can verify that the callback is being called by Facebook by decoding the signed_request.

{
   "signed_request":"PfjakldsFWWs...",
   "buyer":"221159",
   "receiver":"221159",
   "order_id":"9006136047935",
   "order_info":""fbhat"",
   "method":"payments_get_items"
}