Webhook Setup

Receiving Webhook Events

Reap Payments API will send webhooks to your designated URL as a HTTP POST request with a JSON payload. You can provide your URLs via the webhook subscription endpoint, and retrieve, modify, or delete later them as you wish.

Validation

Reap signs the webhook payload that is sent to your endpoint, and you can validate it by verifying the reap-signaturefield attached in the request header:

Extract the reap-signature from the header.
Compute the hash with RSA-SHA512 using the payload and the public key.
Compare the hash with the reap-signature and make sure they match.

const crypto = require('crypto');
const express = require('express');
const bodyParser = require('body-parser');

const port = 3000;

// Place your public keys according to the environment.
// During a key rotation, list both the current and the new key here so that
// either one is accepted. Once the rotation window closes, remove the old key.
const publicKeys = [
  `-----BEGIN PUBLIC KEY-----
...current key...
-----END PUBLIC KEY-----`.replace(/\\n/g, '\n'),

  `-----BEGIN PUBLIC KEY-----
...new key...
-----END PUBLIC KEY-----`.replace(/\\n/g, '\n'),
];

const app = express();
app.use(bodyParser.json());

app.post('/webhook', (req, res) => {
  const message = JSON.stringify(req.body);
  const signature = req.headers['reap-signature'];

  // A verifier cannot be reused, so create a new one for each key.
  const isVerified =
    !!signature &&
    publicKeys.some((publicKey) => {
      const verifier = crypto.createVerify('RSA-SHA512');
      verifier.write(message);
      verifier.end();

      return verifier.verify(publicKey, signature, 'base64');
    });

  console.log('Verified:', isVerified);

  res.send(isVerified ? 'Verification successful!' : 'Verification failed.');
});

app.listen(port, () => {
  console.log(`Webhook server running at http://localhost:${port}`);
});

Public Keys

Current public keys (valid till 30 Sep 2026):

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5JUURpniA359qJLwB9JW
6tFAhc4ChqBiGSBaFTkgmK/XCrV8e/N7q57qq4DwymDk5+ALw8D6cKeG2QkWPDeB
n3ly96sR14+8+2GfS7z82A194V9xEpZQfjF6DeMhidFjhINAAzJHPDiM7QCk9Dh4
/Ny065vzZb0O3ek9Ivs6sbmOKXa/pGACN3k30XLkPu2XxBfeZN1rCFhdwE/wa7Bf
h5AKiA104ais19ct5uf4vNkjG5DwevFK9WiqRVxwzadOyXCk4AdksdFx8ZkOuYWh
rCdIt3Dc+pErfKIHloJ7kqA/8kiWWOP6fWbSSWrEtpLX5ieVsXnqhOYq8xA5WvEo
HwIDAQAB
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsI0a/jqvSM6Z9gTLVMpD
4hLZ0n1WWuSNMwkqNH8s+E6tnBXx6nETgAJKwjdUagwgkySI74rwkCvPqVE0sm9c
iD8oi7XM+X8ybTET8fmVVG5sr12hJX5jQjjBUXzIuuqx5NJt7lFyo2yNrNzCSzuD
AhEa22Gkw43WWZoAVkNXlrfiyprKMfpjf7S4LUsRI/Y6MGyYmfm1olzYksymcaU+
2edfxoB2qZmezyEJM6CPkL2zt8UnnoS+kf/rbmHk+aKf8DW8v+XjeyQSxuclRZi/
IS589AACMygPvsO9KYzMoxmxNLrDcDnlo8+IKHQwE1RLoGC+EzJ0lDxWOEFZMRiE
xwIDAQAB
-----END PUBLIC KEY-----

New public keys (valid from 1 Oct 2026 onwards):

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAs4OHtO2bxgATTDAblGVP
5hh42j8B2tPiLGr+R02R8nXPJKo6MwknpS5pgZbqYO+XAf2aigBnGFPyyelhjnNT
YzK2oUON191mloJJdf0eteCNemB8OOeBlrlSLeQTykTGGDkBMMUvXPMwhyCiv2ww
36+QB0YWVh5BbzYJl8yrEfd6bey1VB8SVUBovcBzNGKRBWveDNie+PirKddWlWci
LkkpfmVRH3xdZu3RfE1SwngTemfpKcKy/e2U3He6OcWf9salAh5GiPmBEbip5wxW
ZKKvGOCuP4PKlzO+MwOBxSDkPN/xARdpm3DozHgfgKG2ST0SSRy6iepbiahegiqt
+DN85ipA7a8Ky9JU4bYMhiBucrPwyg4c2hx3AJrfbLFv+RnY3iWmfQuBWbMnqUFw
ioSiUEKv8mZq7z7qoykUhIsL9Vbe4saPo0V+g9wQUdaqz14UwD2wWImQV7IcTI+V
MKcFrPnBXCRiaUfWyQkfTEdsKtLxr7EmZiKt5uUrrPFGctmiqI7leTyCMZktSZls
nsQKc75fejm8+1Fs0E0u3iZmNaLbxJJ4VJ0DFaYwvkzc60RZ+F9U088zKV2Gmg48
hcB53D8qydttq1mrktymfv+WOy6yUHV13zEUCgvjhBhEwOVgA6r51usafbJXe+Is
98usg5dfUPAXgfcvraxHQ+cCAwEAAQ==
-----END PUBLIC KEY-----

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAxQuT+5FedgTfMVyJEWuY
JM6YaoYC06ZU/Pgp0RIWefbyZuG1vBbwol2bxt/hfyMfBroz+ErSvPcVV0qB8vGU
189cPG3HwrtHk2xDDKbB178cHAseCZNkv0UhdZbndnbg4Aih6Hc5RZvV9P8e6GUa
o6WkMDtw6CqQCHWhKRAqzb3Ev3aseXBPLcko2vhyieRC+lJ85OMPL90dbhERjcLN
elcgMucivxMThB4/VVhCDg79kZfseIBXBmxHn86OASPUKPluoAXCVjsy0g5OfwbP
cAJ2TlzBh4Rr+zof5ROfnfYjhdAJXnhOlArcY2JXBhqVldJC+TLabGCHmHeCg3O+
+jobpQN/1E/GfIZZLaSHhwjQP2qDj1pTpnhiEcsR3tV1gBvLpq2nG1PRKutg+MLx
GmSmUF1LvDiMxGgojTTrsdve5Fdkf9VIK5kIqAXgk3DwqWdkjJnD0JLSY4N2wbEB
ytGOkdpc+POxBeT/eWRlrU40X5grPZeGEbNRLrI8+ezpHlhYYbt7vI4M/0ZM9qF8
Y1sGEF2ma1BfjipXgrFLqQtgf/Vn/m2Wr/zndWKk+YLWzzAqTK8wr0rHlwS8dib6
SB/nYiXhoGpxHwRI7PEM5eb/aAmI6rEWuxOg//vSGpPAvTb8vdDw6LSsPOrXZTcL
sIlY4esD2zcFgNUttt3nfskCAwEAAQ==
-----END PUBLIC KEY-----