Events
Enterprise webhooks deliver events such aswallet.created, transaction.signed, transaction.confirmed, transaction.completed, transaction.failed, gas_station.low_balance, policy.violation, and kyt.deposit.flagged. List supported event types returns the full, current list.
On-chain subscriptions deliver events such as incoming_native_tx, incoming_token_tx, outgoing_native_tx, confirmation_threshold_met, confirmation_finalized, and balance_changed.
Verify every delivery
Each webhook and subscription has a signing secret. It’s shown once, when you create it or rotate it with the rotate-secret endpoint, so store it then. The signature is computed over a canonical JSON object built from three fields of the delivery, and nothing else:1
Build the canonical object
Take
data, event, and timestamp from the delivery and put them in a new object with the keys in that order: data, event, timestamp. Leave out the signature field and anything else in the body.2
Compute and compare
Compute the HMAC-SHA256 with your signing secret, hex-encode it, and prefix it with
sha256=. Compare it with the received value in constant time, and reject the delivery if they differ.3
Check the timestamp
Reject deliveries whose
timestamp is older than your tolerance window, a few minutes for example, so a captured delivery can’t be replayed later.The canonical object must serialize exactly as the platform’s does: keys in lexical order, and Go’s
encoding/json formatting.