Webhooks

Sync verify() is enough for most apps. Use webhooks to push the same decision to another service.

Setup

Dashboard → Integrate → Webhooks
Add an HTTPS URL (test or live)
Copy the signing secret (whsec_…) once
Subscribe to verification.completed

Fires after a successful server POST /v2/verify for matching environment keys.

Envelope

{
  "id": "evt_…",
  "type": "verification.completed",
  "created": 1710000000,
  "data": {
    "object": {
      "event_id": "…",
      "action": "allow",
      "risk_score": 12,
      "reasons": []
    }
  }
}

data.object matches the verify() response.

Signature

X-Keverd-Signature: t=<unix_seconds>,v1=<hmac_sha256_hex>

Also sent: X-Keverd-Event, X-Keverd-Delivery. Signed string: {t}.{raw_request_body}
HMAC-SHA256 with whsec_…, hex digest. Reject if timestamp older than 300 seconds.

Verify the signature against the raw body. Do not parse JSON before verifying.

Use constructEvent / construct_event in the Node, Python, or PHP SDKs.

Getting started

Client Side SDKS

Server Side SDKs

API Reference

Webhooks

Webhooks

Setup

Envelope

Signature

​Webhooks

​Setup

​Envelope

​Signature

Webhooks

Setup

Envelope

Signature