Webhooks

ReplayStack can notify your systems when something important happens. Verify every delivery so you only trust signed payloads.

Payload shape (example)

Incoming POST bodyjson

{
  "id": "evt_webhook_123",
  "event": "payment.succeeded",
  "timestamp": "2026-05-05T14:30:00Z",
  "data": { "orderId": "ord_789", "amount": 149.99 },
  "signature": "sha256=abc123..."
}

Verify signatures

Reject requests that fail HMAC verification.

Node.jstypescript

import crypto from "crypto";

function verifySignature(payload: unknown, signature: string, secret: string) {
  const hash = crypto.createHmac("sha256", secret).update(JSON.stringify(payload)).digest("hex");
  return `sha256=${hash}` === signature;
}

Never process a webhook without validating the signature with your configured secret.