CashSDKCashSDK
Webhooks & API

Stream every purchase to your stack.

Purchases, renewals, and refunds. Signed events for your backend, plus a REST API.

  • Signed & verified
  • Retried with backoff
  • Full REST API
Stream your eventsRead the webhook docs →
cashsdk / webhooks & api Product preview

Your events land wherever you already run.

Your API endpoint
Slack
BigQuery
Snowflake
S3

Signed & verified

Every event is HMAC-signed. Verify in three lines.

Each delivery carries a CashSDK-Signature header. Compute the HMAC-SHA256 of the raw body with your endpoint secret, compare in constant time, and you know it came from us, untampered.

HMAC-SHA256

Signed with your endpoint secret.

Timestamped

Reject replays outside your tolerance window.

Raw-body verify

Sign the exact bytes, before any JSON parse.

Rotatable secrets

Roll keys with overlap, zero downtime.

1import { verifyWebhook } from "cashsdk-node"
2 
3export async function POST(req: Request) {
4  const raw = await req.text()
5  const event = verifyWebhook(raw, {
6    signature: req.headers.get("X-CashSDK-Signature")!,
7    secret: process.env.CASHSDK_WEBHOOK_SECRET!,
8  }) // throws on bad signature or stale timestamp
9 
10  if (event.type === "purchase.completed") {
11    await grantEntitlement(event.data.app_user_id, event.data.product)
12  }
13  return new Response(null, { status: 200 })
14}

Never miss an event

Delivery that keeps trying until it lands.

Non-2xx or a timeout is not a lost event. It is a retry with backoff, fully logged, and replayable on demand.

Automatic retries

Non-2xx or timeout? We retry with exponential backoff over ~72 hours, then park it, no lost events.

attempt 1 · 503attempt 2 · 503attempt 3 · 200

Delivery logs & replay

Every attempt logged with status, latency, and response body. Replay any event or a whole range with one click.

Idempotency

Every event carries a stable event.id. Dedupe on it and process exactly once, even through retries.

Full REST API

Everything the dashboard shows, over HTTP.

Query customers, entitlements, offerings, and events through the REST API.

Customers

Look up any customer and their purchase history.

Entitlements

Read what a user can access, right now.

Offerings

Fetch the products, plans, and prices you render.

Events

Query the full purchase & subscription stream, or page history.

GET/v1/customers/u_812/entitlements
AuthorizationBearer sk_live_…
{
  "active": ["pro_monthly"],
  "expires_at": "2026-08-18",
  "store": "app_store"
}

Try the delivery

Watch an event find its way.

Send a sample. Break the endpoint. Watch the retry.

EVENT DELIVERY / WORKBENCHInteractive sample
event.jsonPOST /your-endpoint
{
  "id": "evt_sample_024",
  "type": "purchase.verified",
  "app_id": "folio",
  "customer_id": "user_024",
  "product_id": "pro.yearly",
  "environment": "sandbox"
}
Signature attached · HTTPS
CashSDK
Your endpoint
DELIVERY TRACE
Event queuedSample event processing
✓
Request signedSample event processing
✓
Event deliveredAcknowledged by your endpoint
200 OK
Simulated delivery · no network requestSample event delivered

Reliable delivery

Built for systems that can't miss.

~72hRetry window with exponential backoff
0Events silently dropped, exhausted deliveries dead-letter
HMACSigned and timestamped, every delivery
ONE CONNECTED PURCHASE FLOW
CashSDK
CashSDK
Store receipt
pro active
A purchase startsproduct: "pro.yearly"A familiar checkout, in your app.
Illustrative flow no live transactions

Wire CashSDK into your whole stack.

Connect your backend to signed purchase events and the REST API.

Stream your eventsRead the webhook docs →