curl --request POST \
--url https://platform.spritz.finance/v1/integrator/webhook-secret \
--header 'Content-Type: application/json' \
--header 'X-Integrator-Key: <api-key>' \
--header 'X-Signature: <api-key>' \
--header 'X-Timestamp: <api-key>' \
--data '
{
"secret": "whsec_abc123def456"
}
'import requests
url = "https://platform.spritz.finance/v1/integrator/webhook-secret"
payload = { "secret": "whsec_abc123def456" }
headers = {
"X-Signature": "<api-key>",
"X-Integrator-Key": "<api-key>",
"X-Timestamp": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Signature': '<api-key>',
'X-Integrator-Key': '<api-key>',
'X-Timestamp': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({secret: 'whsec_abc123def456'})
};
fetch('https://platform.spritz.finance/v1/integrator/webhook-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://platform.spritz.finance/v1/integrator/webhook-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'secret' => 'whsec_abc123def456'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Integrator-Key: <api-key>",
"X-Signature: <api-key>",
"X-Timestamp: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://platform.spritz.finance/v1/integrator/webhook-secret"
payload := strings.NewReader("{\n \"secret\": \"whsec_abc123def456\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Signature", "<api-key>")
req.Header.Add("X-Integrator-Key", "<api-key>")
req.Header.Add("X-Timestamp", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://platform.spritz.finance/v1/integrator/webhook-secret")
.header("X-Signature", "<api-key>")
.header("X-Integrator-Key", "<api-key>")
.header("X-Timestamp", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"secret\": \"whsec_abc123def456\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://platform.spritz.finance/v1/integrator/webhook-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"secret\": \"whsec_abc123def456\"\n}"
response = http.request(request)
puts response.read_body{
"secretConfigured": true
}{
"title": "Unauthorized",
"status": 401,
"type": "urn:problem-type:auth:unauthorized",
"detail": "Bearer token required",
"instance": "<string>",
"realm": "API",
"scope": "read:users"
}{
"title": "<string>",
"status": 404,
"resourceType": "user",
"resourceId": "<string>",
"type": "about:blank",
"detail": "<string>",
"instance": "<string>"
}{
"title": "Unauthorized",
"status": 400,
"type": "urn:problem-type:auth:unauthorized",
"detail": "<string>",
"instance": "/errors/1234567890",
"code": "transaction_limit",
"field": "amountUsd",
"retryable": true,
"retryAfter": 5,
"suggestedAction": "auto_ramp",
"clearsAt": "2023-11-07T05:31:56Z",
"availableAt": "2023-11-07T05:31:56Z",
"permanent": true
}Update webhook secret
Updates the webhook secret used for signing webhook payloads.
Webhook Security: Each webhook request is signed using HMAC SHA256. The signature is computed from the exact JSON payload and included in the Signature HTTP header.
Verification: Compute the HMAC signature using your secret and the raw request body, then compare it to the Signature header before processing.
If no webhook secret is set, webhook requests will not include a Signature header.
curl --request POST \
--url https://platform.spritz.finance/v1/integrator/webhook-secret \
--header 'Content-Type: application/json' \
--header 'X-Integrator-Key: <api-key>' \
--header 'X-Signature: <api-key>' \
--header 'X-Timestamp: <api-key>' \
--data '
{
"secret": "whsec_abc123def456"
}
'import requests
url = "https://platform.spritz.finance/v1/integrator/webhook-secret"
payload = { "secret": "whsec_abc123def456" }
headers = {
"X-Signature": "<api-key>",
"X-Integrator-Key": "<api-key>",
"X-Timestamp": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Signature': '<api-key>',
'X-Integrator-Key': '<api-key>',
'X-Timestamp': '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({secret: 'whsec_abc123def456'})
};
fetch('https://platform.spritz.finance/v1/integrator/webhook-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://platform.spritz.finance/v1/integrator/webhook-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'secret' => 'whsec_abc123def456'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Integrator-Key: <api-key>",
"X-Signature: <api-key>",
"X-Timestamp: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://platform.spritz.finance/v1/integrator/webhook-secret"
payload := strings.NewReader("{\n \"secret\": \"whsec_abc123def456\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Signature", "<api-key>")
req.Header.Add("X-Integrator-Key", "<api-key>")
req.Header.Add("X-Timestamp", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://platform.spritz.finance/v1/integrator/webhook-secret")
.header("X-Signature", "<api-key>")
.header("X-Integrator-Key", "<api-key>")
.header("X-Timestamp", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"secret\": \"whsec_abc123def456\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://platform.spritz.finance/v1/integrator/webhook-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"secret\": \"whsec_abc123def456\"\n}"
response = http.request(request)
puts response.read_body{
"secretConfigured": true
}{
"title": "Unauthorized",
"status": 401,
"type": "urn:problem-type:auth:unauthorized",
"detail": "Bearer token required",
"instance": "<string>",
"realm": "API",
"scope": "read:users"
}{
"title": "<string>",
"status": 404,
"resourceType": "user",
"resourceId": "<string>",
"type": "about:blank",
"detail": "<string>",
"instance": "<string>"
}{
"title": "Unauthorized",
"status": 400,
"type": "urn:problem-type:auth:unauthorized",
"detail": "<string>",
"instance": "/errors/1234567890",
"code": "transaction_limit",
"field": "amountUsd",
"retryable": true,
"retryAfter": 5,
"suggestedAction": "auto_ramp",
"clearsAt": "2023-11-07T05:31:56Z",
"availableAt": "2023-11-07T05:31:56Z",
"permanent": true
}Authorizations
HMAC signature authentication for backend integrators.
Required Headers:
- X-Integrator-Key: Integrator API key (format: ik_...)
- X-Signature: HMAC signature (format: sha256={hex})
- X-Timestamp: Unix timestamp in milliseconds
- Authorization: Bearer {user-api-key}
Signature Algorithm: HMAC-SHA256
Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}
- timestamp: Unix timestamp in milliseconds
- METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
- path: Request path (e.g., /v1/transactions)
- bodyHash: SHA256 hex digest of request body (empty string if no body)
Timestamp Tolerance: ±5 minutes (300 seconds)
Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...
Integrator API key (format: ik_...) used with HMAC authentication
Unix timestamp in milliseconds for request freshness. Must be within 5 minutes of server time. The timestamp alone bounds but does not prevent an exact replay within that window. Use Idempotency-Key on supported mutations.
Body
The secret key used to compute HMAC SHA256 signatures for webhook payloads. The signature is included in the Signature HTTP header of each webhook request.
1"whsec_abc123def456"
Response
Response for status 200
Always true after the webhook secret is configured
true