Webhooks

Pro and above can register up to 5 HTTPS endpoints in Dashboard → Webhooks.

Events: quota.warning (80%), quota.exceeded, request.error, bulk.completed, bulk.failed, key.created, key.disabled, plan.changed, webhook.test.

Each delivery is a POST with body { id, event, data, deliveredAt } and header X-Apizie-Signature: sha256=<hex>, an HMAC-SHA256 of the raw body using your webhook secret.

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody, header, secret) {
  const want = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
  return header && want.length === header.length &&
    timingSafeEqual(Buffer.from(want), Buffer.from(header));
}