> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trepzy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Verify exact body bytes. Deliveries are at-least-once and unordered.

# Webhooks

[Intro](#intro)

<h2 id="intro">
  Intro
</h2>

Public webhooks project canonical events. Verify the raw body, not a re-encoded JSON object. Dedupe on delivery identity. There is no global order guarantee. dto policy follows the public catalog.

See [domains](./domains#intro) and [errors](./errors#intro).

`retrievePayout` remains a current-state read of `payout_ref`; webhook snapshots stay event-time. The public `operation_id` does not change.

<h2 id="verify">
  Verify
</h2>

Header: `Trepzy-Signature: t=<unix>,v1=<hex>`

Message bytes = ASCII `t` + `.` + exact body bytes. HMAC-SHA256 with the endpoint secret. Clock tolerance is 300 seconds in both directions. During rotation the header may carry one `t` and two `v1` values.

```ts theme={null}
const operationId: string = 'retrievePayout'
const headerName: string = 'Trepzy-Signature'
const toleranceSeconds: number = 300
```

Verifier snippets for the seven languages live in `snippets/webhook-verify/`.