Platform

Webhooks

Subscribe to purchase and conversion events. Signed with HMAC-SHA256. Idempotent by design.

Add a webhook endpoint in Settings → Webhooks. We will POST a JSON envelope for every subscribed event, with the signature in the X-Experiwall-Signature header.

import crypto from "crypto";

export function verify(body: string, sig: string, secret: string) {
  const expected = crypto.createHmac("sha256", secret).update(body).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig));
}

Every delivery includes an event_id. Persist it and skip duplicates; we may retry up to five times with exponential backoff.