Webhooks
Webhook endpoints are managed in the Swop app, not with an API key.
Webhooks can't be created, listed, tested or removed with a merchant API key. They're managed in the Swop web app under Dashboard → Developer → Webhooks, while you're signed in. That's a deliberate security choice: if an API key leaked, it still couldn't redirect where your "paid" notifications go.
| You want to | Where |
|---|---|
| Add an endpoint and get its signing secret | Developer page → Webhooks → Add |
Send a signed test (ping) | Developer page → Send test |
| See status, last delivery, failures | Developer page |
| Change URL, events or secret | Remove the webhook and add it again |
Events
| Event | Fires when |
|---|---|
checkout.paid | The buyer's money arrived and the order exists |
payout.released | Swop released your money |
ping | You pressed Send test |
Signature header
Swop-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">, keyed with your whsec_ secret. Reject anything older than 5 minutes.