Skip to main content

Overview

Webhooks Dashboard Overview

Why Use Webhooks?

⚡ Real-time Updates

Receive notifications instantly when events happen

🔄 Automatic Retries

Failed deliveries are automatically retried

🔒 Secure Verification

Every webhook includes a signature to verify authenticity

📊 Event Logging

Complete history of all webhook deliveries

🎯 Selective Events

Subscribe only to the events you care about

🚀 Scalable

Handle high-volume event streams

Event Types

Wildcard Subscriptions

Address Events

Master Wallet Events

Address Settlement Rule Events

Master Settlement Rule Events

Here is the complete and comprehensive MDX section for Webhook Payloads with all event types and their corresponding mock payloads:

Webhook Payloads

All webhook payloads follow a consistent structure with common fields:
  • id: Unique event identifier
  • type: The event type (matches the EventTypes enum)
  • version: API version
  • timestamp: ISO 8601 timestamp of when the event occurred
  • data: The event-specific payload
Event Type: address.incoming_transferTriggered when a transfer is detected on an address (child wallet).

Webhook Headers

When delivering webhook events, XentFi includes important metadata in the HTTP headers. These headers help you verify the authenticity of the request and provide context about the event.

Request Headers

Signature Format

The X-Webhook-Signature header follows this format:
Where:
  • t is the Unix timestamp in milliseconds
  • v1 is the HMAC-SHA256 signature using your webhook secret

Signature Verification Example

To verify the webhook signature, follow this process:

Important Security Notes

Always verify the webhook signature before processing any webhook event. This ensures the request came from XentFi and not from an imposter.
  • Check timestamp tolerance - Reject signatures with timestamps older than 5 minutes to prevent replay attacks
  • Use constant-time comparison - Use crypto.timingSafeEqual() to prevent timing attacks
  • Never trust unverified webhooks - Only process events after successful signature verification
  • Store secrets securely - Webhook secrets are sensitive credentials; never expose them in logs or client-side code

Example Webhook Delivery Request

Here’s a complete example of what a webhook delivery request looks like:

Response Requirements

Your webhook endpoint should respond with a status code in the 2xx range to indicate successful delivery:
Best Practice: Respond with a 2xx status code as quickly as possible. If you need to perform heavy processing, consider using a queue system to process the webhook asynchronously and return a 202 Accepted response.

Setting Up Webhooks

Via Dashboard

1

Navigate to Webhooks

Go to Settings > Webhooks in the dashboard
2

Create Webhook

Click the Create Webhook button
3

Configure Webhook

Fill in the webhook details:
  • URL: Your endpoint URL (must be HTTPS)
  • Name: A descriptive name
  • Event Types: Select the events you want to receive
4

Copy Secret

Copy the generated webhook secret for signature verification
5

Save and Test

Click Save and test your webhook with a test event
Webhook Details and Event Logs

Via API

Response:

Managing Webhooks

List Webhooks

Get Webhook Details

Update Webhook

Rotate Webhook Secret

Send Test Webhook Event

Response:

Retry Logic

Retry Schedule

Webhook Events & Retries

You can monitor webhook event delivery status:
Response:

Get Webhook Event Details

Best Practices

  • Always verify signatures - Never trust unverified webhooks
  • Respond quickly - Return 2xx within 5 seconds
  • Idempotent processing - Handle duplicate webhooks gracefully
  • Log all webhooks - Keep audit trail for debugging
  • Monitor failures - Set up alerts for failed deliveries
  • Queue processing - Use message queues for async handling
  • Keep endpoints public - Must be accessible from the internet

Webhook Headers

Event Delivery Status

Troubleshooting

Possible causes:
  • Endpoint not publicly accessible
  • Firewall blocking requests
  • Invalid URL format
  • Webhook not active
Solutions:
  • Verify URL is accessible from internet
  • Check firewall rules
  • Ensure URL includes https://
  • Verify webhook is active in dashboard
Possible causes:
  • Wrong secret used
  • Payload body modified
  • Encoding issues
Solutions:
  • Rotate and update secret
  • Use raw request body
  • Verify JSON stringification
Solutions:
  • Implement idempotency using webhook ID
  • Check for processed flag in your database
  • Use unique constraint on webhook ID
Solutions:
  • Process webhooks asynchronously
  • Use message queue (RabbitMQ, SQS)
  • Return 202 Accepted for long processing

API Reference

Payment Links

Payment event notifications

Auto Settlement

Settlement event notifications

Master Wallets

Wallet event notifications

Next Steps