Webhooks

Setup

1. Go to Developers in your Brykto dashboard.
2. Enter your webhook URL and click Save.
3. Copy your webhook secret (used to verify requests).

The order.paid event

When a payment is confirmed, Brykto sends a POST request to your webhook URL with this payload:

{
  "event": "order.paid",
  "request_id": "pr_abc123",
  "amount": "49.99",
  "currency": "USD",
  "receive_asset": "USDC",
  "stablecoin_amount": 49.99,
  "tx_hash": "abc123def456...",
  "paid_at": "2026-08-08T12:00:00"
}

Verifying the signature

Every request includes an X-Brykto-Signature header. Verify it before processing:

import hmac
import hashlib

def verify(body: bytes, header: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

Retries

Brykto retries failed webhook deliveries 3 times with 30-second delays. Your endpoint must return a 200 status within 10 seconds to be considered successful.

Replay protection

Store confirmed tx_hash values in your database and reject any event with a duplicate hash.