Webhook vs email
A webhook is for your systems; an email is for a person. Today only a few events send either: see the list in Notifications.
When you get which
| Event | Webhook | |
|---|---|---|
| A crypto checkout is paid | checkout.session.completed to every endpoint subscribed to it | The workspace owner |
| Business verification submitted or decided | No | Yes |
| Personal identity check decided | No | Yes |
Verifying a webhook
verify.tstypescript
import { createHmac, timingSafeEqual } from "node:crypto";
function verify(rawBody: string, header: string, secret: string): boolean {
const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
const t = Number(parts.t);
if (!t || Math.abs(Date.now() / 1000 - t) > 300) return false; // older than 5 min
const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
const given = Buffer.from(parts.v1 ?? "", "hex");
const want = Buffer.from(expected, "hex");
return given.length === want.length && timingSafeEqual(given, want);
}Deliveries can arrive more than once. Each one carries the same id across
retries, so store the IDs you've handled and skip repeats.
How to subscribe
- Webhooks: email support@sorenpay.com with your endpoint URL and the events you want. We send you the signing secret. Self-serve endpoints in the dashboard are coming.
- Emails: sent automatically to the person concerned. There are no settings to change them yet.