Signed webhooks
Deliveries you can verify two independent ways, replay yourself from the dashboard, and receive on a built-in inbox if you have nowhere to host an endpoint yet.
Any developer whose system has to react when money moves: order systems, school platforms, accounting tools, dispatch systems.
Part of the platform itself: it is present wherever BitriPay runs.
The problem
Polling is wasteful, late and fragile. Webhooks solve that only if you can tell a real one from a forged one, and only if a delivery that fails while your server is down is not simply lost.
How it works
- Register an endpoint and choose the events you care about.
- Verify the signature on arrival, answer quickly, and do your work afterwards.
- Deduplicate on the event id, because delivery is at-least-once by design.
- Replay anything from the dashboard when you need to.
What you can check
Facts about the running platform rather than adjectives. Each one is visible in the product, the API reference or the ledger.
- Two signatures per delivery: an HMAC-SHA256 over the timestamped body with your endpoint secret, and an Ed25519 signature from the platform key registry.
- Retries follow a published schedule across 24 hours; deliveries are not dropped because your server was restarting.
- Every event carries an id so a repeated delivery can be recognised and ignored.
- A built-in inbox receives events for an account that has nowhere to host an endpoint yet, so the integration can be built before the server exists.
What it costs
Included. There is no per-delivery charge.
Questions
Why at-least-once and not exactly-once?
Because exactly-once delivery over a network does not exist, and a provider claiming it is describing something else. Every event has an id; deduplicate on it and you get exactly-once processing, which is the thing you actually wanted.
My server was down for an hour. What did I lose?
Nothing that happened inside the retry window. Deliveries are retried on a published schedule across 24 hours, and you can replay anything from the dashboard afterwards.
I have not built my server yet.
Use the built-in inbox. Events for your account land somewhere you can read them, so you can see the exact shape of a real event before you write a line of handling code.
Read next
The gateway API
A payments API whose documentation is generated from the same table that serves the requests, so the reference can never describe an endpoint the platform does not have.
Connected accounts
Create your customers’ merchant accounts by API, take payments for them with your own key, keep your fee — and hand the account over whenever they are ready, keys and history intact.