> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wepayout.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Signature

> Learn how to verify webhook signatures to ensure secure communication

## Overview

Our webhooks include a signature in the request headers to ensure authenticity and integrity. This document explains how the signature is generated and how you can verify it to ensure that the webhook payload was sent by our system.

## Webhook Signature

When we send a webhook, the `x-webhook-wp-signature` header will contain a Bearer token. This token is a SHA256 hash that you can use to verify the authenticity of the webhook request.

### Payin Webhook Signature

For a Payin webhook, you need to concatenate the following fields in the exact order:

```
{id}{key}{amount}{api_key}
```

Where:

* `{id}`: The unique identifier of the transaction
* `{key}`: A specific key associated with the transaction. In the case of Payin creation, the value used for key is the `hash` field returned in the response
* `{amount}`: The amount involved in the transaction
* `{api_key}`: Your API key used for authentication

<Warning>
  In Payin webhooks, for cases where the Payin is canceled and the `paid_amount` field in the webhook is null, the `{amount}` value used in the signature calculation is still the original amount that was specified when the Payin was created — not the null value.

  Therefore, always ensure that signature verification uses the original Payin amount, regardless of the payment status.
</Warning>

### Payout Webhook Signature

For a Payout webhook, the following fields should be concatenated:

```
{invoice}{currency}{amount}{api_key}
```

Where:

* `{invoice}`: The invoice number of the payout transaction
* `{currency}`: The currency used in the payout
* `{amount}`: The amount of the payout
* `{api_key}`: Your API key used for authentication

### Automatic PIX Webhook Signature

For Automatic PIX related data (authorizations, schedules and payins' webhooks), the following fields should be concatenated:

```
{merchant_id}{contract_id}{api_key}
```

Where:

* `{merchant_id}`: Merchant ID of the user that created the authorization
* `{contract_id}`: Contract ID of the authorization
* `{api_key}`: API Key of the user that created the authorization

## Signature Verification

To verify the webhook's authenticity:

1. Concatenate the required fields (depending on whether the webhook is for a Payin, Payout, or Automatic PIX)
2. Generate a SHA256 hash of the concatenated string
3. Compare the generated hash with the token provided in the `x-webhook-wp-signature` header

If the hashes match, the webhook is verified as authentic.

## Examples

### Payin

For a Payin webhook with the following data:

* `{id}` = 123456
* `{key}` = ABCD
* `{amount}` = 10.00
* `{api_key}` = FF9876543210

**Concatenated string**: `123456ABCD10.00FF9876543210`

To verify the authenticity of the webhook, generate the SHA256 hash of this string and compare it with the `x-webhook-wp-signature` header.

### Payout

For a Payout webhook with the following data:

* `{invoice}` = WE00000001
* `{currency}` = BRL
* `{amount}` = 5.00
* `{api_key}` = FF99775566ffddhh

**Concatenated string**: `WE00000001BRL5.00FF99775566ffddhh`

To verify the authenticity of the webhook, generate the SHA256 hash of this string and compare it with the `x-webhook-wp-signature` header.

### Automatic PIX

For an Automatic PIX webhook with the following data:

* `{merchant_id}` = 467
* `{contract_id}` = A001
* `{api_key}` = FF99775566ffddhh

**Concatenated string**: `467A001FF99775566ffddhh`

To verify the authenticity of the webhook, generate the SHA256 hash of this string and compare it with the `x-webhook-wp-signature` header.

## Related Resources

<CardGroup cols={2}>
  <Card title="KYC Webhook" icon="webhook" href="/api-reference/kyc/webhook">
    Learn about KYC webhooks
  </Card>

  <Card title="Payin Callback" icon="arrow-down" href="/api-reference/cash-in/payin/callback-charge">
    Payin webhook callback
  </Card>

  <Card title="Payout Callback" icon="arrow-up" href="/api-reference/cash-out/payout/callback-payment">
    Payout webhook callback
  </Card>
</CardGroup>

<Note>
  For any further questions or issues, please reach out to our support team.
</Note>