Webhooks are callbacks that notify events in your account. A webhook will make an HTTP request to your application (usually by the POST method), whose body will contain an object describing the associated event. They are incredibly useful and a simple way to implement reactions to events.For example: When a capture of an authorization is generated, a Webhook allows you to receive a notification so that you can take an action, such as sending a thank you email to the user.Webhooks are also helpful in two situations:When a generated event is not a direct result of a call to the API. For example, a chargeback.
When services or features need the response to a call, but they do not perform it directly. For example, an accounting service that needs to update accounting records when a transaction is generated.
When updating a customer's membership in your database when payment is successful.
When recording an accounting entry after a transaction is made.
Consume a Webhook#
The first step to consume a Webhook is creating an endpoint to receive them. This is not different from creating any other page on your website. Simply create a new path with the desired URL.Webhook data is sent in JSON format in the body of the POST call. All the event details are included and can be used directly (after parsing the JSON).Security#
Encryption#
You may use an HTTP or an HTTPS URL for webhooks. In most cases, an HTTP is enough, but HTTPS may be useful if you're dealing with sensitive data or if you want to protect your system against replay attacks, for example.Authentication#
In principle, anyone could send a request to your endpoint, so it is important to verify that these webhooks originate from Kushki. Therefore, to verify their authenticity, valid Webhooks will contain the following headings:X-Kushki-Key: Merchant ID.
X-Kushki-Signature: It is the HMAC SHA256 signature of the body of the request, plus the timestamp, using your Webhook signature ID.
X-Kushki-SimpleSignature: Corresponds to the HMAC SHA256 signature of the X-Kushki-Id, using your webhook signature ID.
X-Kushki-Id: Date in timestamp format (UNIX Time).
What is the IP used to send notifications from Kushki?Notifications are sent from the following static IP of Kushki, you can also check this as an additional validation.Production: 34.230.185.20
X-Kushki-Signature and X-Kushki-SimpleSignature for the check.How to get the Webhook Signature?#
You can view and copy the webhook signature from the Console. To do this, go to Desarrolladores > Webhooks. At the top you can easily copy the webhook signature.Examples#
Below you'll find some examples of how to perform a signature check in the headings.X-Kushki-Signature#
X-Kushki-SimpleSignature#
According to the functionalities you have integrated, there will be different types of body for requests:
Modified at 2026-07-10 17:34:40
