Subscribe to webhook events

Real-time notifications for invoice, service, and security events. JSON POST to your endpoint.

Create a webhook

1. Portal → Account → Webhooks → Create.
2. URL: your HTTPS endpoint.
3. Events: pick from 40+ (invoice.paid, invoice.overdue, service.suspended, service.terminated, 2fa.enabled, api_key.created, …).
4. Save. Copy the signing secret — shown once.

Verify signatures

# Each request carries:
#   X-Orvoxa-Signature: sha256=<hex>
#   X-Orvoxa-Timestamp: <unix-ts>

expected = hmac_sha256(secret, timestamp + "." + body)
assert_equal(expected, request.header("X-Orvoxa-Signature"))
assert(now() - timestamp < 300)  # reject replays

Retry policy

Non-2xx responses get retried with exponential backoff: 10s, 30s, 5m, 1h, 6h, 24h. After 24h we mark the endpoint failing and disable delivery until you manually re-enable.