Register a URL to receive webhook events. The response includes a secret that you must store securely — it is used to verify webhook signatures.
Zet signs every webhook payload with HMAC-SHA256 using this secret. The signature is sent in the x-zet-signature header.
Verification example:
const crypto = require('crypto');
function verifyWebhook(payload, signature, secret) {
const expected = crypto
.createHmac('sha256', secret)
.update(JSON.stringify(payload))
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
);
}
Your Zet API key. Contact zetdotmoney@gmail.com to obtain your keys.
HTTPS URL to receive webhook POST requests.
"https://yourapp.com/webhooks/zet"
List of event types to subscribe to. Use * for all events.
onramp.completed, onramp.failed, offramp.completed, offramp.failed, swap.completed, swap.failed, transfer.completed, transfer.failed, * ["onramp.completed", "offramp.completed"]Optional description for this webhook.
"Production payment webhook"