Eleven events. Signed. At least once.

The full transaction lifecycle, pushed to your backend

Requested, approved, rejected, broadcast, mined, failed — plus incoming deposits at first sight and at confirmation. Payloads are HMAC-SHA256 signed, carry idempotency keys, and retry with backoff. Your backend reacts; it does not poll.

Share the Trust, Guard the Keys

Create accountLive on testnet in an afternoon

Compare PlansIncluded in a plan, not an add-on

The problem

Polling is how integrations learn about money late

Every polling loop is a trade-off between API load and how stale your ledger is. Webhooks invert it: eleven signed event types push each state change to your backend as it happens, with delivery evidence you can inspect and replay.

Signed, so verifiableEvery delivery carries an HMAC signature over the payload — your endpoint can prove the event came from us.
Retried with backoffFailed deliveries are retried on an exponential schedule, so a short outage on your side does not lose an event.
At least once, by designHandle events idempotently. Duplicate delivery is a guarantee we keep, not a bug we hide.

How it works

The event contract

Eleven event types cover outgoing state transitions and incoming deposits (coin, token and internal). Confirmation events fire per-chain: 6 blocks on Bitcoin-family, 12 on EVM — credit users exactly as your risk policy dictates.

✓HMAC-SHA256 signature header on every delivery; HTTPS only
✓At-least-once with idempotency keys — dedupe is a one-liner
✓Delivery logs retained; replay from the dashboard

event types

TRANSACTION_REQUEST TRANSACTION_APPROVED / REJECTED TRANSACTION_BROADCASTED OUTGOING_MINED / FAILED / MINED_WITH_ERRORS INCOMING_MINED_TX INCOMING_CONFIRMED_COIN_TX / TOKEN_TX / INTERNAL_TX

Specification

Delivery specification

What arrives, how it is signed, and what happens when your endpoint is down.

Event typesEleven, covering the transaction lifecycle: requested, approved, rejected, broadcast, mined, failed, plus incoming detection and confirmation.

SignatureHMAC-SHA256 over the payload, with a timestamped header.

RetriesExponential backoff on failure; deliveries and their responses are logged.

ReplayCallback logs are queryable and a delivery can be resent from the dashboard.

RetentionDelivery evidence is kept for years rather than days — useful when a counterparty disputes a timeline.

EndpointsNone on Entry, three on Standard, five on Business, negotiated on Enterprise.

ScopeSubscriptions cover vaults, vault accounts and individual addresses.

IdempotencyEvents carry keys so a duplicate is trivially discarded on your side.

Frequently asked questions

Get answers to commonly asked questions.

What if our endpoint is down?

Retries with exponential backoff first; delivery logs are kept and events can be re-sent from the dashboard. Combined with the API as source of truth, nothing is lost.

How do we verify authenticity?

Check the HMAC signature header against your webhook secret — standard practice, non-optional in our docs.

Which plans?

Included from Standard.