Developers

Webhooks

Receive events in real time and verify signatures.

Updated 2 Oct 2026

Every event is a JSON POST with an X-Plainflow-Signature header.

Example payload

{
  "event": "request.approved",
  "id": "PR-1042",
  "amount": 98700,
  "currency": "THB",
  "approved_at": "2026-10-02T09:14:00+07:00"
}

Verify the signature

code

const expected = hmacSHA256(rawBody, WEBHOOK_SECRET);
if (!timingSafeEqual(expected, header)) return res.status(401).end();

Reply with a 2xx within 10 seconds or we'll retry.