Update webhook secret

curl --request POST \
  --url https://platform.spritz.finance/v1/integrator/webhook-secret \
  --header 'Content-Type: application/json' \
  --header 'X-Integrator-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "secret": "whsec_abc123def456"
}
'

import requests

url = "https://platform.spritz.finance/v1/integrator/webhook-secret"

payload = { "secret": "whsec_abc123def456" }
headers = {
    "X-Signature": "<api-key>",
    "X-Integrator-Key": "<api-key>",
    "X-Timestamp": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Signature': '<api-key>',
    'X-Integrator-Key': '<api-key>',
    'X-Timestamp': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({secret: 'whsec_abc123def456'})
};

fetch('https://platform.spritz.finance/v1/integrator/webhook-secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform.spritz.finance/v1/integrator/webhook-secret",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'secret' => 'whsec_abc123def456'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Integrator-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.spritz.finance/v1/integrator/webhook-secret"

	payload := strings.NewReader("{\n  \"secret\": \"whsec_abc123def456\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("X-Integrator-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://platform.spritz.finance/v1/integrator/webhook-secret")
  .header("X-Signature", "<api-key>")
  .header("X-Integrator-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"secret\": \"whsec_abc123def456\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://platform.spritz.finance/v1/integrator/webhook-secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"secret\": \"whsec_abc123def456\"\n}"

response = http.request(request)
puts response.read_body

{
  "secretConfigured": true
}

{
  "title": "Unauthorized",
  "status": 401,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "Bearer token required",
  "instance": "<string>",
  "realm": "API",
  "scope": "read:users"
}

{
  "title": "<string>",
  "status": 404,
  "resourceType": "user",
  "resourceId": "<string>",
  "type": "about:blank",
  "detail": "<string>",
  "instance": "<string>"
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

Integrator

Update webhook secret

Updates the webhook secret used for signing webhook payloads.

Webhook Security: Each webhook request is signed using HMAC SHA256. The signature is computed from the exact JSON payload and included in the Signature HTTP header.

Verification: Compute the HMAC signature using your secret and the raw request body, then compare it to the Signature header before processing.

If no webhook secret is set, webhook requests will not include a Signature header.

POST

integrator

webhook-secret

Update webhook secret

curl --request POST \
  --url https://platform.spritz.finance/v1/integrator/webhook-secret \
  --header 'Content-Type: application/json' \
  --header 'X-Integrator-Key: <api-key>' \
  --header 'X-Signature: <api-key>' \
  --header 'X-Timestamp: <api-key>' \
  --data '
{
  "secret": "whsec_abc123def456"
}
'

import requests

url = "https://platform.spritz.finance/v1/integrator/webhook-secret"

payload = { "secret": "whsec_abc123def456" }
headers = {
    "X-Signature": "<api-key>",
    "X-Integrator-Key": "<api-key>",
    "X-Timestamp": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'X-Signature': '<api-key>',
    'X-Integrator-Key': '<api-key>',
    'X-Timestamp': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({secret: 'whsec_abc123def456'})
};

fetch('https://platform.spritz.finance/v1/integrator/webhook-secret', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform.spritz.finance/v1/integrator/webhook-secret",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'secret' => 'whsec_abc123def456'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Integrator-Key: <api-key>",
    "X-Signature: <api-key>",
    "X-Timestamp: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform.spritz.finance/v1/integrator/webhook-secret"

	payload := strings.NewReader("{\n  \"secret\": \"whsec_abc123def456\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("X-Integrator-Key", "<api-key>")
	req.Header.Add("X-Timestamp", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://platform.spritz.finance/v1/integrator/webhook-secret")
  .header("X-Signature", "<api-key>")
  .header("X-Integrator-Key", "<api-key>")
  .header("X-Timestamp", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"secret\": \"whsec_abc123def456\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://platform.spritz.finance/v1/integrator/webhook-secret")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Signature"] = '<api-key>'
request["X-Integrator-Key"] = '<api-key>'
request["X-Timestamp"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"secret\": \"whsec_abc123def456\"\n}"

response = http.request(request)
puts response.read_body

{
  "secretConfigured": true
}

{
  "title": "Unauthorized",
  "status": 401,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "Bearer token required",
  "instance": "<string>",
  "realm": "API",
  "scope": "read:users"
}

{
  "title": "<string>",
  "status": 404,
  "resourceType": "user",
  "resourceId": "<string>",
  "type": "about:blank",
  "detail": "<string>",
  "instance": "<string>"
}

{
  "title": "Unauthorized",
  "status": 400,
  "type": "urn:problem-type:auth:unauthorized",
  "detail": "<string>",
  "instance": "/errors/1234567890",
  "code": "transaction_limit",
  "field": "amountUsd",
  "retryable": true
}

Authorizations

X-Signature

string

header

required

HMAC signature authentication for backend integrators.

Required Headers:

X-Integrator-Key: Integrator API key (format: int_...)
X-Signature: HMAC signature (format: sha256={hex})
X-Timestamp: Unix timestamp in milliseconds
Authorization: Bearer {user-api-key}

Signature Algorithm: HMAC-SHA256

Signature Format: {timestamp}.{METHOD}.{path}.{bodyHash}

timestamp: Unix timestamp in milliseconds
METHOD: HTTP method in UPPERCASE (GET, POST, etc.)
path: Request path (e.g., /v1/transactions)
bodyHash: SHA256 hex digest of request body (empty string if no body)

Timestamp Tolerance: ±5 minutes (300 seconds)

Example: For POST /v1/transactions with body {"amount":100} and timestamp 1234567890000: Payload: 1234567890000.POST./v1/transactions.{sha256(body)} Signature: sha256=abc123...

X-Integrator-Key

string

header

required

Integrator API key (format: int_...) used with HMAC authentication

X-Timestamp

string

header

required

Unix timestamp in milliseconds for replay attack prevention. Must be within 5 minutes of server time.

Body

secret

string

required

The secret key used to compute HMAC SHA256 signatures for webhook payloads. The signature is included in the Signature HTTP header of each webhook request.

Minimum string length: 1

Example:

"whsec_abc123def456"

Response

Response for status 200

secretConfigured

enum<boolean>

required

Always true after the webhook secret is configured

Available options:

true

Auto-Ramp Accounts

Auto-Ramp Addresses

Off-Ramp Quotes

Off-Ramps

On-Ramps

Bank Accounts

Funding Sources

Deposits

Bills

Cards

Debit Cards

Integrator Connect

Integrator

Users

Compliance

Terms

API Keys

Device Authorization

Wallet Kit

Sandbox

Update webhook secret

Authorizations

Body

Response