Webhooks
Firsty pushes eSIM, package, and port-in events to your endpoint, signed per the Standard Webhooks specification.
HMAC-SHA256 signature following the Standard Webhooks spec.
Firsty signs every outgoing webhook request. To verify authenticity:
- Concatenate:
{webhook-id}.{webhook-timestamp}.{raw-request-body} - Compute HMAC-SHA256 keyed with the base64-decoded bytes of your
signingSecretafter itswhsec_prefix - Base64-encode the result
- Compare with the
v1,{base64-signature}value in this header
Reject requests where the signature does not match or where webhook-timestamp is outside an acceptable time window (e.g. ±5 minutes) to prevent replay attacks. A Standard Webhooks library performs all of these checks.
Delivery headers
webhook-idstringUnique identifier of this delivery. Stays the same across the delivery's retries; use it as the idempotency key.
webhook-timestampstringUnix timestamp (seconds since epoch) of the webhook delivery attempt
webhook-signaturestringHMAC signature(s) for payload verification (format: v1,base64-signature)