Webhooks

{
  "id": "evt_xxxxxxxx",
  "type": "invoice.paid",
  "created": "2026-01-15T10:30:00Z",
  "data": {
    "id": "inv_xxxxxxxx",
    "customerId": "cus_xxxxxxxx",
    "status": "paid",
    "totalMinor": 9900,
    "currency": "USD"
  }
}

curl -X POST "https://api.revkeen.com/v1/webhooks" \
  -H "Authorization: Bearer rk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/webhooks/revkeen",
    "events": ["invoice.paid", "subscription.created", "subscription.cancelled"]
  }'

const webhook = await client.webhooks.create({
  url: 'https://yourapp.com/webhooks/revkeen',
  events: [
    'invoice.paid',
    'subscription.created',
    'subscription.cancelled',
  ],
});

// Store the signing secret securely
console.log(webhook.data.secret);

webhook = client.webhooks.create(
    url="https://yourapp.com/webhooks/revkeen",
    events=[
        "invoice.paid",
        "subscription.created",
        "subscription.cancelled"
    ]
)

# Store the signing secret securely
print(webhook.data.secret)

X-RevKeen-Signature: t=1673856000,v1=5d2c67...abc123

import crypto from 'crypto';

function verifyWebhook(
  payload: string,
  signature: string,
  secret: string
): boolean {
  const [timestamp, sig] = signature.split(',').map(s => s.split('=')[1]);

  // Reject old timestamps (>5 minutes)
  const age = Date.now() - parseInt(timestamp) * 1000;
  if (age > 300000) {
    throw new Error('Webhook timestamp too old');
  }

  // Compute expected signature
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`)
    .digest('hex');

  // Constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(sig),
    Buffer.from(expected)
  );
}

// Express.js example
app.post('/webhooks/revkeen', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-revkeen-signature'] as string;
  const payload = req.body.toString();

  try {
    if (!verifyWebhook(payload, signature, process.env.WEBHOOK_SECRET!)) {
      return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(payload);

    switch (event.type) {
      case 'invoice.paid':
        handleInvoicePaid(event.data);
        break;
      case 'subscription.cancelled':
        handleSubscriptionCancelled(event.data);
        break;
    }

    res.json({ received: true });
  } catch (err) {
    res.status(400).send(`Webhook Error: ${err.message}`);
  }
});

import hmac
import hashlib
import time
import json
from fastapi import FastAPI, Request, HTTPException

def verify_webhook(payload: str, signature: str, secret: str) -> bool:
    parts = dict(p.split('=') for p in signature.split(','))
    timestamp = parts['t']
    sig = parts['v1']

    # Reject old timestamps (>5 minutes)
    age = time.time() - int(timestamp)
    if age > 300:
        raise ValueError('Webhook timestamp too old')

    # Compute expected signature
    expected = hmac.new(
        secret.encode(),
        f'{timestamp}.{payload}'.encode(),
        hashlib.sha256
    ).hexdigest()

    # Constant-time comparison
    return hmac.compare_digest(sig, expected)

@app.post('/webhooks/revkeen')
async def webhook_handler(request: Request):
    signature = request.headers.get('x-revkeen-signature')
    payload = await request.body()

    if not verify_webhook(payload.decode(), signature, WEBHOOK_SECRET):
        raise HTTPException(status_code=401, detail='Invalid signature')

    event = json.loads(payload)

    if event['type'] == 'invoice.paid':
        await handle_invoice_paid(event['data'])
    elif event['type'] == 'subscription.cancelled':
        await handle_subscription_cancelled(event['data'])

    return {'received': True}