Soon (v3)
Webhook
Events only a platform key can subscribe to
Was this page helpful?
Events only a platform key can subscribe to
t={unix},v1={hex}: HMAC-SHA256 over {t}.{raw body} using the signing_secret returned once by POST /v3/webhooks/registrations. Verify before trusting the body: recompute over the raw bytes you received, before parsing, compare in constant time, and reject anything older than five minutes. This signs deliveries from us, not x-chargeflow-signature with v2, which signs requests to us.
The delivery's webhookId. Equal to the id a test delivery answered with.
application/json
This delivery. Also sent as X-Chargeflow-Webhook-Request-ID.
The event. Stable across every retry: deduplicate on it.
date-timeThe event type.
Follows the environment. Always false on a test delivery.
The event payload. Its shape is set by the event type.
Example Requests
/alerts.enrollment.status_changed