Skip to main content
WEBHOOK

Authorizations

Authorization
string
header
required

Your secret key: sk_test_… on the sandbox host, sk_live_… on live. A key on the wrong host gets a 401 wrong_environment. Keys are secret. Keep them on your server, never in a browser or app.

Headers

webhook-id
string
required

The event id. The same on every retry and every endpoint, so dedupe on it.

Example:

"event_2wq8n5hkd7xm3rpa"

webhook-timestamp
string
required

Unix seconds of this attempt. Reject it if it's more than 5 minutes from your clock.

Example:

"1761732000"

webhook-signature
string
required

v1, + base64 of HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{body}, keyed with the base64-decoded part of your secret after whsec_ (the Standard Webhooks scheme).

Example:

"v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4="

Body

application/json
id
string
required

Also sent as the webhook-id header.

Example:

"event_2wq8n5hkd7xm3rpa"

type
enum<string>
required
Available options:
payout.created,
payout.updated,
payout.awaiting_funds,
payout.pending,
payout.processing,
payout.paid,
payout.failed,
payout.returned,
payout.canceled,
payout.expired,
batch.created,
batch.processing,
batch.awaiting_funds,
batch.awaiting_payees,
batch.completed,
batch.partially_completed,
batch.failed,
batch.canceled,
payee.created,
payee.details_pending,
payee.verifying,
payee.active,
payee.inactive,
deposit.created
Example:

"deposit.created"

created_at
string<date-time>
required

When the change happened, not when it was delivered.

Example:

"2026-10-26T10:05:30Z"

api_version
enum<string>
required
Available options:
v1
environment
enum<string>
required
Available options:
live,
sandbox
Example:

"sandbox"

data
object
required

Response

200

Answer any 2xx within 10 seconds.