Webhook verification

Clearway signs outbound merchant webhook deliveries. Verify signatures before trusting event payloads in your backend.

Headers

Each delivery includes:

• x-clearway-signature — HMAC signature of the raw body
• x-clearway-timestamp — Unix timestamp (reject stale events)

Verification steps

1. Read the raw request body (do not parse JSON first).
2. Concatenate {timestamp}.{rawBody}.
3. Compute HMAC-SHA256 with your endpoint signing secret.
4. Compare using a constant-time equality check.

Configure endpoints and rotate secrets in the dashboard under Developer → Webhooks at https://app-dev.clearway.to/developer/webhooks/endpoints.

Event types and envelope fields are documented in Webhook events. Platform billing webhooks are separate from merchant payment event webhooks.

Next steps

• Webhook events — event type catalog
• Errors — delivery failure handling
• Dashboard vs API — registration is dashboard-only