Webhooks

When you create a check with "async": true, AbuseZero responds right away and sends the result to your webhook endpoint when scoring finishes.

Verifying signaturesCopy Anchor Link

Every webhook includes an AbuseZero-Signature header. It's an HMAC-SHA256 of the timestamp and raw body, signed with your webhook secret:

import { verifyWebhook } from '@abusezero/node';

export async function POST(request: Request) {
  const event = verifyWebhook(
    await request.text(),
    request.headers.get('abusezero-signature'),
    process.env.ABUSEZERO_WEBHOOK_SECRET
  );

  if (event.type === 'check.completed') {
    // grant or block the benefit
  }

  return new Response(null, { status: 200 });
}

RetriesCopy Anchor Link

If your endpoint doesn't return a 2xx status, we retry with exponential backoff for up to 24 hours. See the check.completed event in the API reference for the payload.