Webhooks — outbound event delivery for your integrations.

Register HTTPS endpoints to receive real-time events: usage recorded, budget exceeded, key lifecycle, and rate-limit alerts. All deliveries are signed with HMAC-SHA256 (X-AiT-Signature header).

🔒Signing secret is shown once at registration. Verify X-AiT-Signature on every incoming webhook to prevent spoofing.

Active Endpoints

registered

Last Delivery OK

2xx on last attempt

Failing

need attention

Pending Delivery

no attempts yet

Webhook Endpoints (0)

Could not load webhook endpoints from Supabase. Check env vars.

URL	Events	Last Delivery	Last Status	Registered	Actions

Signature Verification

Verify the X-AiT-Signature header on every incoming request. The value is sha256=<hmac-sha256-hex> where the HMAC is computed over the raw request body using your signing secret.

// Node.js / Next.js verification example
import crypto from 'node:crypto';

function verifyWebhook(rawBody: string, signature: string, secret: string): boolean {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected),
  );
}