Webhooks
Verify a signature
HMAC SHA-256 of the raw body, hex-encoded.
- Read the raw request body. Do not re-serialize JSON before you hash it.
- Compute HMAC SHA-256 with the endpoint secret from Settings.
- Compare the hex digest to
X-Zyptos-Signaturein constant time. - Reject the request when they differ.
Razorpay subscription and wallet events are separate. Compare X-Razorpay-Signature with the webhook secret from the Razorpay dashboard.