Skip to main content

​
Webhooks

Intro

​
Intro

Public webhooks project canonical events. Verify the raw body, not a re-encoded JSON object. Dedupe on delivery identity. There is no global order guarantee. dto policy follows the public catalog. See domains and errors. retrievePayout remains a current-state read of payout_ref; webhook snapshots stay event-time. The public operation_id does not change.

​
Verify

Header: Trepzy-Signature: t=<unix>,v1=<hex> Message bytes = ASCII t + . + exact body bytes. HMAC-SHA256 with the endpoint secret. Clock tolerance is 300 seconds in both directions. During rotation the header may carry one t and two v1 values.
Verifier snippets for the seven languages live in snippets/webhook-verify/.