Docs

Webhooks

Receive trade-event streams as HTTP POSTs. Signed with HMAC-SHA256.

Registering an endpoint

Add a webhook URL in Dashboard → Webhooks. We send events at-least-once with exponential retry up to 24 hours.

Signature verification

Each request carries X-Getway-Signature: t=<unix>,v1=<hex>. Compute HMAC-SHA256 over `t.body` with your endpoint secret and compare in constant time.

import crypto, hmac
def verify(body: bytes, header: str, secret: str) -> bool:
    parts = dict(p.split('=', 1) for p in header.split(','))
    t, sig = parts['t'], parts['v1']
    expected = hmac.new(secret.encode(), f"{t}.".encode() + body, 'sha256').hexdigest()
    return hmac.compare_digest(expected, sig)

Idempotency

Each delivery has a unique X-Getway-Delivery-Id. Use it to deduplicate on your side.