Webhooks

Invitebase signs every webhook with an HMAC signature so you can verify it came from us.

verify-webhook.ts

import { verifyWebhook } from '@invitebase/node';

export async function POST(req: Request) {
  const event = verifyWebhook({
    payload: await req.text(),
    signature: req.headers.get('invitebase-signature')!,
    secret: process.env.INVITEBASE_WEBHOOK_SECRET!,
  });

  switch (event.type) {
    case 'invite.redeemed':
      // grant the reward
      break;
  }

  return new Response('ok');
}

Placeholder page — full event catalog, delivery semantics, and retry policy land here.