Webhooks let you receive real-time notifications when transactions are confirmed or fail on-chain. Instead of polling the transactions endpoint, register a URL and Camino will POST signed payloads to it.
Every webhook delivery is signed with your secret using HMAC-SHA256. Verify the signature to ensure the payload was sent by Camino.The X-Webhook-Signature header has the format:
t={timestamp},v1={signature}
To verify:
import { createHmac } from 'crypto';function verifyWebhook(body, header, secret) { // Parse the signature header const parts = Object.fromEntries( header.split(',').map(p => p.split('=')) ); const timestamp = parts.t; const signature = parts.v1; // Strip the whsec_ prefix from the secret const rawSecret = secret.replace(/^whsec_/, ''); // Compute expected signature: HMAC-SHA256(secret, "timestamp.body") const expected = createHmac('sha256', rawSecret) .update(`${timestamp}.${body}`) .digest('hex'); // Compare signatures return signature === expected;}// In your webhook handler:app.post('/webhooks/camino', (req, res) => { const body = req.body; // raw string body const header = req.headers['x-webhook-signature']; const secret = process.env.CAMINO_WEBHOOK_SECRET; if (!verifyWebhook(body, header, secret)) { return res.status(401).send('Invalid signature'); } const payload = JSON.parse(body); console.log(`Event: ${payload.event}`, payload.data); res.status(200).send('OK');});
