API Documentation

Signature Verification

All webhook deliveries include an X-Webhook-Signature header containing an HMAC-SHA256 signature. Verify this signature to ensure the webhook came from our system.

Node.js Example:

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// In your webhook handler:
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const payload = req.body;
  const secret = 'YOUR_WEBHOOK_SECRET';
  
  if (verifyWebhookSignature(payload, signature, secret)) {
    // Signature valid - process the webhook
    console.log('Event:', payload.event);
    res.status(200).send('OK');
  } else {
    // Invalid signature
    res.status(401).send('Invalid signature');
  }
});

Available Events