Webhooks & API
Stream every purchase to your stack.
Signed, retried webhooks and a complete REST API pipe every purchase, renewal, and refund into your backend, CRM, and warehouse — the moment it happens.
- Signed & verified
- Retried with backoff
- Full REST API
Event delivery streaming
CashSDK
Your API
Your CRM
Warehouse
event logdelivery
purchase.completed signed
subscription.renewed signed
refund.issued signed
purchase.completed signed
Your events land wherever you already run.
Your API endpoint
Slack
BigQuery
Snowflake
S3Signed & verified
Every event is HMAC-signed. Verify in three lines.
Each delivery carries a CashSDK-Signature header. Compute the HMAC-SHA256 of the raw body with your endpoint secret, compare in constant time, and you know it came from us — untampered.
HMAC-SHA256
Signed with your endpoint secret.
Timestamped
Reject replays outside your tolerance window.
Raw-body verify
Sign the exact bytes, before any JSON parse.
Rotatable secrets
Roll keys with overlap, zero downtime.
1import { verifyWebhook } from "@cashsdk/node"2 3export async function POST(req: Request) {4 const raw = await req.text()5 const event = verifyWebhook(raw, {6 signature: req.headers.get("CashSDK-Signature")!,7 secret: process.env.CASHSDK_WEBHOOK_SECRET!,8 }) // throws on bad signature or stale timestamp9 10 if (event.type === "purchase.completed") {11 await grantEntitlement(event.data.app_user_id, event.data.product)12 }13 return new Response(null, { status: 200 })14}Never miss an event
Delivery that keeps trying until it lands.
Non-2xx or a timeout is not a lost event — it is a retry with backoff, fully logged, and replayable on demand.
Automatic retries
Non-2xx or timeout? We retry with exponential backoff over ~72 hours, then park it — no lost events.
attempt 1 · 503attempt 2 · 503attempt 3 · 200
Delivery logs & replay
Every attempt logged with status, latency, and response body. Replay any event or a whole range with one click.
Idempotency
Every event carries a stable event.id. Dedupe on it and process exactly once, even through retries.
Full REST API
Everything the dashboard shows, over HTTP.
Read customers, entitlements, offerings, and the full event stream over a clean, versioned REST API — the same data the dashboard renders.
Customers
Look up any customer and their purchase history.
Entitlements
Read what a user can access, right now.
Offerings
Fetch the products, plans, and prices you render.
Events
Query the full purchase & subscription stream, or page history.
GET/v1/customers/u_812/entitlements
AuthorizationBearer sk_live_…
{
"active": ["pro_monthly"],
"expires_at": "2026-08-18",
"store": "app_store"
}
Built to run where the real traffic is.
At-least-once delivery, ordered per customer, observable end to end.
Reliable delivery
Built for systems that can't miss.
0.00%
Delivery success
~0h
Retry window with backoff
0
Events silently dropped
Wire CashSDK into your whole stack.
Stream every purchase, renewal, and refund to your backend, CRM, and warehouse over signed, retried webhooks and a full REST API.