Webhooks tell your server about every payment, purchase and payout change. Add one address per project and check the signature on every call.
Add the address
- Open the project and fill in Webhook URL. It must be a public https address.
- Press Save settings, then Send test.ping. The dashboard shows whether your server accepted it.
What we send
A POST with a JSON body: the event type (for example deposit.in_hold, deposit.success, deposit.hold_returned, purchase.accepted or payout.paid), whether it is live or test, and the object itself. Every event type is listed in the API reference.
Check the signature
Each call carries a SkinPlata-Signature header with a timestamp and an HMAC-SHA256 signature made with your webhook signing secret. Compute it from the raw body and compare before you trust anything. The API reference has ready-made samples.
Answer fast
Reply with any 2xx status within a few seconds, then do the slow work. Other answers count as failures and we retry for about two days.
Credit safely
- Handle each event once: the same event may arrive more than once.
- Re-read the payment from the API before giving value on your side.
- Take value back when a payment is reversed, see Trade protection and releasing early.
Every delivery, its answer and its retries are listed under Webhooks in the dashboard. If nothing arrives, see Webhooks not arriving: what to check.