Code in

Tutorial: webhooks

Add a webhook, check its signature, handle each event once, and test it before you go live.

Melden Sie sich an, um Ihre eigene Test-Client-ID in den Beispielen zu sehen.

Webhooks tell your server when something happens that you did not cause: somebody signed in, took back your access, or changed their plan.

1. Add an address

On your app's Webhooks page, add an https address for the test environment and choose the events you want. The signing secret starts whsec_ and is shown once: keep it as ATHERON_WEBHOOK_SECRET.

Your address must be public. We never deliver to a private or loopback address, and never follow a redirect.

2. Check every delivery

Read the raw body before any JSON parser touches it, and check Atheron-Signature against it.

Dieses Beispiel gibt es noch nicht in cURL. Gezeigt in TypeScript.

// Check that a webhook came from Atheron before you act on it. Pass the raw body, exactly as received.
import { verifyWebhook, type WebhookEvent } from "@aton-network/sdk";

export async function handleWebhook(request: Request): Promise<Response> {
  const raw = await request.text();
  const ok = await verifyWebhook(request.headers.get("atheron-signature"), raw, process.env.ATHERON_WEBHOOK_SECRET!);
  if (!ok) return new Response("bad signature", { status: 400 });
  const event = JSON.parse(raw) as WebhookEvent;
  if (event.type === "consent.revoked") {
    // Delete the refresh token you hold for event.data.sub, and stop using what you read.
  }
  return new Response(null, { status: 204 });
}

3. Handle each event once

Every delivery carries Atheron-Event-Id. Keep the ids you handled for a day and answer 2xx to a repeat without doing the work again. A delivery that does not get a 2xx within ten seconds is tried again, up to seven more times over nearly two days.

When somebody takes back your access you get consent.revoked. Delete the refresh token you hold for that sub and stop using what you read, as the data-use policy says.

5. Test it

Press Send a test on the Webhooks page. You get a ping at once, and the page shows each attempt with its status. If your endpoint missed some, press Resend beside a delivery, or Resend the ones that gave up, once it is back.

The full list of events and fields is in Webhooks.

Fragen Sie Atlas

KI-Assistent