Webhooks provide the most effective method to track the state of deposits. Every time the status of a deposit changes, a webhook will be sent to any of the addresses that you have added in the dashboard.

Set up webhooks:

1. Log into the dashboard
2. Click “Webhooks” under the API menu
3. Select “+ Add URL”

Delivery Attempts and Retries

Every webhook that receives a non-200 response will be considered a failure. If there is a delivery failure, we will retry the delivery for up to 3 hours.

Handling Events

You can identify deposit updates from the “event” property in the webhook payload. Deposit updates will have "event" :" deposit-update”. There may be other webhook events with a different “event” value (i.e "payout-update”) which are not related to deposits.

Duplicate Events

Every deposit has a unique identifier ‘deposit_id’. On some occasions, it is possible to receive multiple webhooks for the same event. Please be careful to not create duplicate transactions from webhooks that have the same ‘deposit_id’. For example, if a deposit update changes to status “confirmed”, it is possible that this webhook may be delivered multiple times for that event.

Order of Events

The “status” property in the event payload can be “submitted” or “confirmed”. The status will only change from “submitted” to “confirmed” in that order.

Amounts

Two amounts may be included in status updates:

• “verified_amount”: this is the amount that is verified by our system.
• “amount”: this is the amount which is posted to the ‘stat deposit’ endpoint.

Please only use ‘verified_amount’   for crediting customer accounts when a deposit status has been updated to ‘confirmed’.

Validation

When adding a webhook URL in the dashboard, it is recommended to include a secret. This will be used to create a hash signature with each payload that is passed with each request under the 'X-Nitro-Signature' header. The hash signature is calculated using HMAC with SHA256 algorithm, with your webhook secret set as the key and the webhook request body as the message.

A set of IP addresses will be provided that you can whitelist.