Okwerin

Developers

Webhooks

Webhooks tell your systems what happened: an agreement was sent, viewed, completed or declined, a payment succeeded, a renewal is approaching.

Verify the signature

The Okwerin-Signature header contains t=timestamp and v1=HMAC-SHA256 of "timestamp.body" using your signing secret. Reject deliveries older than five minutes.

const expected = crypto
  .createHmac("sha256", signingSecret)
  .update(`${timestamp}.${rawBody}`)
  .digest("hex");

Retries

Failed deliveries are retried immediately, then after 1, 5, 30, 120 and 720 minutes. After six attempts the delivery is marked exhausted and stays in the log for manual redelivery.

Payload

Each delivery carries event_id, event_type, created_at, organization_id, api_version and data, so the schema stays stable across versions.