Using SQUAKE Webhooks API
Using SQUAKE Webhooks API to receive notifications about your customers' purchase-related events
Register webhooks to receive notifications about your customers' purchase-related events, and validate that each notification came from SQUAKE.
What are webhooks?
Webhooks are HTTP callbacks that notify your application when events happen in SQUAKE's system. Instead of continuously polling our API, webhooks push data to your endpoint when events occur.
Common use cases
- Payment status notifications
- Documents status updates (compensation confirmation/certificates are ready)
Implementation guide
You can set up different webhooks for different kinds of events:
| Kind | What we send |
|---|---|
order | An event when a purchase which was made via Stripe changes status |
confirmation_document_available | A document when it’s generated |
certificate_document_available | A document when it’s generated |
Validating incoming webhooks
When SQUAKE sends webhooks to your endpoint, we include a signature in the headers that allows you to verify that the request came from us. Here's how to validate the webhooks:
Headers
Each webhook request includes the following security-related headers:
HTTP_SQUAKE_SIGNATURE: HMAC-SHA256 signature of the payloadHTTP_SQUAKE_TIMESTAMP: ISO8601-formatted timestamp of when the webhook was sent
Validation process
- Get the raw request body as a string
- Get the signature from the
HTTP_SQUAKE_SIGNATUREheader - Calculate the HMAC-SHA256 using your signing key:
# Example in Ruby
payload = request.raw_post # Get raw request body
signature = OpenSSL::HMAC.hexdigest('SHA256', SIGNING_KEY, payload)
# Compare signatures (use secure comparison)
secure_compare(signature, request.headers['HTTP_SQUAKE_SIGNATURE'])Request body format
{
// ... webhook payload ...
}Kinds of webhooks
Order webhook
Type: order
Whenever you request a pricing using /pricing endpoint, it’s possible to pass a payment_method: "stripe" parameter. If it’s passed then we’ll return a paymet_link in the response:
You can add extra query parameters to this link in order to help you to track a specific purchase later, when you receive a webhook. One of the parameters you can pass is: external_reference .
If you’ll add it to the link:
https://checkout.squake.test?t=eyJhbGciOiJIUzI1NiJ9.eyJwIjoicHJpY2VfZFJTbmtVIiwiY3EiOjEuMCwiY3UiOiJ0b25uZSIsInQiOjEyMzMxLCJ0ZSI6MTIzMzEsImwiOiJlbiIsImMiOiJFVVIiLCJleHAiOjE3MzU4MTUzMTIsImZ0IjowLCJwbSI6InN0cmlwZSJ9.xO4V8-l4aPPJOAFYIjbUCiYRKbzyUZJYbf3j-umV-8A&external_reference=YOUR_EXTERNAL_REFERENCE
Then we’ll send it back to you in the webhook payload.
Whenever payment is done/cancelled/refunded, we’ll send you a webhook, here’s an example webhook payloads:
{
"external_reference": "YOUR_EXTERNAL_REFERENCE",
"purchase_id": "purchase_123456",
"payment_status": "succeeded"
}Possible payment_status values:
| Value | Meaning |
|---|---|
complete | Payment successfully completed |
canceled | Payment is canceled |
failed | Payment failed to process |
succeeded | Payment is successful |
refunded | Payment is refunded |
settled | Payment received by SQUAKE |
Confirmation document available
Type: confirmation_document_available
Notifies you when a compensation confirmation document is ready for download.
Payload
{
"id": "file_XXX-XXX-XXX-XXX-XXX",
"filename": "SQUAKE-CompensationCertificate-euc1XXX.pdf",
"purpose": "confirmation_document",
"size": 100,
"type": "pdf",
"download_url": "https://squake.s3.eu-central-1.amazonaws.com/...."
}Certificate document available webhook
Type: certificate_document_available
Notifies you when a certificate document is ready for download.
Payload
{
"id": "file_XXX-XXX-XXX-XXX-XXX",
"filename": "SQUAKE-CompensationCertificate-euc1XXX.pdf",
"purpose": "certificate_document",
"size": 100,
"type": "pdf",
"download_url": "https://squake.s3.eu-central-1.amazonaws.com/...."
}Webhook API reference
See Webhook API Reference for more details.