Webhooks
Firsty pushes eSIM, package, and port-in events to your endpoint, signed per the Standard Webhooks specification.
HMAC-SHA256 signature following the Standard Webhooks spec.
Firsty signs every outgoing webhook request. To verify authenticity:
- Concatenate:
{webhook-id}.{webhook-timestamp}.{raw-request-body} - Compute HMAC-SHA256 using your webhook secret
- Base64-encode the result
- Compare with the
v1,{base64-signature}value in this header
Reject requests where the signature does not match or where webhook-timestamp is outside an acceptable time window (e.g. ±5 minutes) to prevent replay attacks.
Delivery headers
webhook-idstringrequiredUnique identifier for the webhook event
webhook-timestampstringrequiredUnix timestamp (seconds since epoch) of the webhook delivery attempt
webhook-signaturestringrequiredHMAC signature(s) for payload verification (format: v1,base64-signature)