Webhooks

Warka can notify your server about events. Configure endpoints in the console and verify every signature.

Event	Sent when
verification.completed	A verification has a decision
identity.enrolled	An identity is enrolled or re-enrolled
identity.deleted	An identity is deleted
usage.threshold	You pass 80% or 100% of your attempts

Verifying a signature

verify-webhook.ts

import { createHmac, timingSafeEqual } from "node:crypto";

export function isValid(rawBody: string, timestamp: string, header: string, secret: string) {
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected = "v1=" + createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  return header.split(",").some((candidate) => {
    const a = Buffer.from(candidate.trim());
    const b = Buffer.from(expected);
    return a.length === b.length && timingSafeEqual(a, b);
  });
}

Headers: Warka-Timestamp, Warka-Signature and Warka-Event-Id. Use the event ID to ignore duplicates.
Return any 2xx quickly. Failed deliveries retry with backoff, up to 8 attempts.
After a secret rotation both secrets sign for 24 hours.
Targets must be public https addresses. Payloads never include scores or images.