POST JSON to your HTTPS endpoint.
Configure
GET /api/v1/webhooks
Returns your current webhook URL and whether a secret is set (the secret value is not shown again).
PATCH /api/v1/webhooks
Set url and optionally rotate the secret. Use the same Authorization: Bearer sk_live_… header as other API calls.
You can also set the Webhook URL and rotate the secret in the app.
Verify the signature
Each delivery includes an HMAC signature of the raw body. Compute the same HMAC with your webhook secret and compare it to the header before you process the payload. Reject requests that do not match.Events you may receive
Payloads include an event name and data scoped to your organization.
Respond with
2xx quickly. Signyd retries failed deliveries.