Webhooks

Signed events for orders, refunds, check-ins and pages.

Konecto sends signed POST requests to your endpoints and retries with backoff for up to 72 hours.

Event	When
order.paid	A checkout completed and tickets were issued
order.refunded	An order was fully or partly refunded
attendee.registered	A free registration was completed
ticket.checked_in	A ticket was scanned at the door
event.published	An event was published
event.updated	Event details changed
event_page.published	The event page was published
module.enabled	A module was enabled
challenge.completed	An attendee completed a challenge
booth.scanned	An exhibitor scanned an attendee at a booth

Payload

{
  "id": "evt_2Lm...",
  "type": "order.paid",
  "created": "2026-11-14T18:02:11Z",
  "data": { "order": { "id": "ord_91x", "event": "acme-summit", "total": 4000, "currency": "gbp", "tickets": 2 } }
}

Verify the signature

Each request has a Konecto-Signature header: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body"> with your endpoint secret. Reject requests older than five minutes.

import crypto from 'node:crypto';

export function verify(body: string, header: string, secret: string) {
  const [t, v1] = header.split(',').map((p) => p.split('=')[1]);
  const expected = crypto.createHmac('sha256', secret).update(t + '.' + body).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
  return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

Plain-text version for agents: llm.konec.to/docs/api/webhooks.md