Webhook events.

Verify a delivery

Compute an HMAC-SHA256 of the raw request body using the endpoint's signing secret (shown once on creation, rotatable from the endpoint kebab menu). Compare the result to the value in X-SendMint-Signature.

// Node.js, verify an incoming webhook
import crypto from "node:crypto";

function verifyWebhook(
  rawBody: string,
  signature: string | null,
  secret: string,
): boolean {
  if (!signature) return false;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

Event catalog

Every event ships a JSON body with shape { id, type, createdAt, data }. The type matches the event key listed below.