Skip to main content

Outbound webhooks

Receive signed donation events at your HTTPS endpoint.

A
Written by Antonio Ryckman

Spark and above. Go to Integrations → Webhooks.

  1. Add your HTTPS URL.

  2. Subscribe to donation.completed, and optionally donation.refunded and donation.failed.

  3. Copy the signing secret (shown once).

  4. Click Send test and confirm your server received the payload.

Verify signatures

Each request includes X-Sharity-Timestamp and X-Sharity-Signature (t=<unix>,v1=<hmac>). Compute HMAC-SHA256 of {timestamp}.{rawBody} with the signing secret and compare to the v1 hex value. Reject requests with a timestamp too far from now.

Use the event id for idempotency. Failed deliveries are retried automatically. Never expose the signing secret in client-side code.

Did this answer your question?