Ship banking features this afternoon.

Webhooks

Signed events for every movement

Every payload is signed with HMAC-SHA256 and retried with backoff until you acknowledge it. Replay any event from the dashboard.

const sig = req.headers["x-paddle-signature"];
const expected = crypto
  .createHmac("sha256", process.env.PADDLE_WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");

if (sig !== expected) return res.status(401).end();

// { "event": "virtual_account.credited",
//   "data": { "amount": 5000000, "currency": "NGN" } }