Webhooks

Authentication

How to make sure the webhook request is originated from Align:

• Make sure x-hmac-signature is present in the header

• Generate the keyed hash of the payload using HMAC-SHA256 function and the API auth key

• Hex encode the hash

• Compare the hex encoded hash with the x-hmac-signature header sent by Align

Events

We publish webhooks events for Customer, Onramp Transfer, Offramp Transfer related activities. Here is event structure:

type WebhookEvent = {
    event_type: 
        'customer.kycs.updated' |
        'onramp_transfer.status.updated' |
        'offramp_transfer.status.updated';
    entity_id: string;
    entity_type: 
        'customer' |
        'onramp_transfer' |
        'offramp_transfer';
    created_at: string;
}