verifyWebhook()

Webhooks require separate CRISP assessment and enablement; this helper does not imply access or delivery guarantees. Use account sync or cursor reads for standard account updates. Use raw request bytes and the separate webhook secret, not your API secret. Throws on failed verification. You must durably deduplicate event IDs before applying side effects.

events workflow · All SDK methods

Import and runtime

@crisp-trade/partner-sdk — server only; never expose credentials to the browser.

Client setup and shared behavior

Arguments

{
    rawBody: Uint8Array;
    secret: string;
    timestamp: string;
    signature: string;
    eventId: string;
    cursor: string;
    now?: number;
    maxSkewMs?: number;
}

Example

Example IDs and intent keys are illustrative. Replace them with authenticated account resources and your persisted intent. Browser route names are example routes you implement on your own backend.

import { verifyWebhook } from '@crisp-trade/partner-sdk';
// In your server request handler; headers and rawBody come from that request.
const event = verifyWebhook({
  rawBody,
  secret: webhookSecret,
  timestamp,
  signature,
  eventId,
  cursor,
});
console.log(event.id, event.type);

Returns

The exact return type is shown below; this helper does not use the ordinary HTTP response wrapper.

{
    id: string;
    cursor: string;
    version: 1;
    type: "account.status_changed" | "order.updated" | "trade.recorded" | "balance.updated" | "funding.updated" | "withdrawal.updated" | "position.redeemed" | "settlement.updated" | "reconciliation.completed";
    externalUserId: string;
    accountId: string;
    occurredAt: string;
    data: {
        [key: string]: unknown;
    };
}

Errors and lifecycle

Errors and retry policy. Financial uncertainty requires recovery with the original intent, never a new key. Realtime helpers must be stopped on logout/account switch.

Related HTTP operations

This utility does not directly map to one HTTP request.

Exact released types

Extracted from the shipped SDK 0.13.0, not separately maintained signatures.

verifyWebhook(input: {
    rawBody: Uint8Array;
    secret: string;
    timestamp: string;
    signature: string;
    eventId: string;
    cursor: string;
    now?: number;
    maxSkewMs?: number;
}): {
    id: string;
    cursor: string;
    version: 1;
    type: "account.status_changed" | "order.updated" | "trade.recorded" | "balance.updated" | "funding.updated" | "withdrawal.updated" | "position.redeemed" | "settlement.updated" | "reconciliation.completed";
    externalUserId: string;
    accountId: string;
    occurredAt: string;
    data: {
        [key: string]: unknown;
    };
}