Webhooks: get events pushed to you

A webhook sends an HTTP POST to your server when something happens on your account: an offer arrives, an order is paid, a transfer moves, a listing sells.

Add an endpoint#

1. Open Webhooks in your member menu.
2. Enter the URL of your endpoint. It must use https and be reachable from the internet.
3. Tick the Events you want, such as offer received, order paid or listing sold.
4. Save and copy the signing secret.
5. Send a test ping to check that your endpoint answers.

Verify every delivery#

Each request carries these headers:

• X-AIOD-Event: the event name.
• X-AIOD-Delivery: a unique ID. Use it to ignore a delivery you already handled.
• X-AIOD-Timestamp: when it was sent.
• X-AIOD-Signature: sha256= followed by an HMAC-SHA256 of the timestamp, a dot and the raw body, made with your secret.

Work out the same HMAC on your side and compare. Reject requests that do not match or are old.

Retries#

Answer with a 2xx status quickly. If your endpoint fails, we try again several times with growing gaps. After too many failures in a row the endpoint is switched off and you get a notice. Fix it and switch it on again. You can re-send any delivery from its log.

The number of endpoints you can have depends on your plan. Rotate the secret if it may have leaked.

Related: API keys and your first request.