Register Webhook

Register a URL to receive outbound event notifications.

The HMAC signing secret is generated server-side and returned once in this response — store it securely. You will use it to verify the Stablepay-Signature header on every delivered event.

Signature verification (Node.js):

const crypto = require('crypto');
function verify(secret, body, sigHeader) {
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(body).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(sigHeader), Buffer.from(expected));
}

Event types:

Pass an empty events array to subscribe to all event types.