Webhooks

Events

Signature verification

Vexoli signs each delivery as HMAC-SHA256 over timestamp + "." + raw body, using your webhook secret. Headers: X-Vexoli-Timestamp and X-Vexoli-Signature. Always use the raw request body and a constant-time comparison.

// Node.js (Express, raw body required)
const crypto = require("crypto");

function verify(req, secret) {
  const ts = req.headers["x-vexoli-timestamp"];
  const sig = req.headers["x-vexoli-signature"]; // hex HMAC-SHA256
  const raw = req.rawBody; // exact bytes received — do NOT re-serialise JSON
  const expected = crypto.createHmac("sha256", secret)
    .update(ts + "." + raw).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected));
}
// Reject events whose timestamp is more than 5 minutes old.

Retries

Return any 2xx quickly; do heavy work async. If delivery fails (non-2xx or timeout), Vexoli retries on this schedule, then marks the delivery as failed in the dashboard where you can replay it:

Make your handler idempotent: the same event may be delivered more than once. Deduplicate by event / order ID.