Skip to content
Pipevest Developers

Validations

Planned — on our roadmap. Signed outbound webhooks and public-key retrieval are not yet enabled. Until they ship, learn a payment outcome by polling payment status. If webhooks are part of your integration plan, contact us.

Webhook signatures need to be verified in order to guarantee that the webhook was sent from our system and was not tampered with via a man in the middle attack.

Public Key

Section titled “Public Key”

Upon configuring a webhook, a cryptographic public key is generated for verifying the webhook message signatures. This verification process assures the authencity and integrity of the webhook message.

Validate Webhook Message

Section titled “Validate Webhook Message”

Retrieve Public Key

That key can be retrieved by making a GET request to /webhooks/key

Terminal window
  curl --request GET \
    --url https://api.pipevest.com/v1/webhooks/key \
    --header 'Authorization: Bearer 123456' \
    --header 'Signature: sig1=:OTEyMjY4...A5NTNDMEQ=:' \
    --header 'Signature-Input: sig1=("content-type" "content-digest" "content-length" "authorization" "x-client-id" "x-idempotency-key" "@method" "@target-uri" "@path" "@query");keyid="staging-pipevest-ed25519";created=1732893484;expires=1732893584' \
    --header 'X-Client-Id: 123456' \

Verify Content Digest

Content Digest

Learn more about content digest

Verify HTTP Message Signature

Message Signature

Learn more about message signatures