Skip to main content
When Obiex sends webhook events (e.g., deposits, withdrawals), it includes a security header so you can verify the request came from Obiex.

​
Setting Up Webhooks

  1. Log in to your Obiex dashboard
  2. Navigate to Settings > Developers > Webhook Url
  3. Add your webhook endpoint URL
  4. Copy your Signature Secret

​
Signature Verification

All webhook requests include the header: 
x-obiex-signature: <HMAC-SHA512 hex digest>
This signature is generated using your Signature Secret as a HMAC SHA512 of the raw request body.

​
Verifying the Signature

  1. Read the raw request body as a string (do not parse first)
  2. Read the x-obiex-signature header
  3. Compute HMAC SHA512 of the raw body using your Signature Secret
  4. Hex-encode the result
  5. Compare with the received signature

​
Example: Node.js (Express)

import crypto from 'crypto';
import express from 'express';

const app = express();
const signatureSecret = process.env.OBIEX_SIGNATURE_SECRET!;

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const receivedSignature = req.headers['x-obiex-signature'] as string;
  const body = req.body.toString();
  
  const computedSignature = crypto
    .createHmac('sha512', signatureSecret)
    .update(body)
    .digest('hex');
  
  if (computedSignature !== receivedSignature) {
    return res.status(401).send('Invalid signature');
  }
  
  // Signature is valid - process webhook
  const webhookEvent = JSON.parse(body);
  console.log('Received webhook:', webhookEvent);
  
  res.status(200).send('Received');
});

app.listen(3000, () => {
  console.log('Listening for webhooks on port 3000');
});

​
Handling Webhook Events

Common webhook events include:
  • deposit.completed - Crypto deposit confirmed
  • withdrawal.completed - Crypto withdrawal processed
  • withdrawal.failed - Crypto withdrawal failed
  • bank_transfer.completed - Fiat deposit/withdrawal completed
Always verify the signature before processing any webhook event to ensure it was sent by Obiex.