Reference

Webhooks

Real-time, bank-verified events, this is what replaces the customer screenshot. Every delivery is signed and retried on failure.

Signature

Every webhook carries an X-Ollie-Signature header: HMAC-SHA512(your webhook secret, raw request body), hex-encoded. Verify against the raw bytes, re-serializing the parsed JSON before verifying will produce a different signature and fail.

verify.ts

import { createHmac, timingSafeEqual } from "crypto";

function verifySignature(rawBody: string | Buffer, signature: string, secret: string): boolean {
  const expected = createHmac("sha512", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && timingSafeEqual(a, b);
}

// Using the Node SDK instead:
import { Tuago } from "@tuago/node";
app.post("/tuago-webhook", (req, res) => {
  const event = Tuago.webhooks.constructEvent(req.rawBody, req.headers["x-ollie-signature"], endpointSecret);
  if (event.type === "charge.success") { /* confirm the order */ }
  res.sendStatus(200);
});

Event types

charge.successcharge.failedcharge.pendingvirtualaccount.assignedsettlement.successsettlement.failedrefund.processedrisk.flagged

Retries

A non-2xx response is retried with exponential backoff: 1m, 5m, 30m, 2h, 6h, 24h, up to a configurable max attempt count. You can also trigger a manual resend for any event from the dashboard.

Configure endpoints and inspect delivery history under Developers → Webhooks in the dashboard.