Webhooks.

Set up an endpoint

1. In the panel, open Integrations → Webhooks and add your URL.
2. Choose the event types it receives.
3. Copy the signing secret and verify every delivery with it.
4. Click Send test event to send a TEST event, whatever types the endpoint listens for.

An endpoint can also send a fixed Authorization header with every delivery, for backends that already check one.

Endpoints receive only events recorded while they are active. Turning one on later does not replay earlier events.

Payload

Each delivery is a POST with a JSON body:

{
  "api_version": "1.0",
  "event": {
    "id": "6f1d1c1e-7a1b-4f0e-9a52-0b1f4d3e2c11",
    "type": "RENEWAL",
    "event_timestamp_ms": 1769904000000,
    "app_id": "app_8c1f",
    "app_user_id": "user_123",
    "original_app_user_id": "user_123",
    "aliases": ["user_123", "$anonymous_9f2c"],
    "store": "PLAY_STORE",
    "environment": "PRODUCTION",
    "product_id": "premium:monthly",
    "benefit_ids": ["premium"],
    "presented_package_id": "default",
    "period_type": "NORMAL",
    "purchased_at_ms": 1769904000000,
    "expiration_at_ms": 1772582400000,
    "transaction_id": "GPA.3345-1234-5678-90123..1",
    "original_transaction_id": "GPA.3345-1234-5678-90123",
    "renewal_number": 2,
    "is_trial_conversion": false,
    "is_family_share": false,
    "country_code": "TR",
    "currency": "TRY",
    "price": 5.12,
    "price_in_purchased_currency": 149.99,
    "tax_percentage": 0.1667,
    "commission_percentage": 0.125,
    "takehome_percentage": 0.85,
    "subscriber_attributes": {
      "$email": { "value": "[email protected]", "updated_at_ms": 1767225600000 }
    }
  }
}

Event types

Trial starts, refunds and promotional grants can be chosen on their own when you set up an endpoint (TRIAL, REFUND, PROMOTIONAL_GRANT, PROMOTIONAL_REVOKE). They are delivered as the types above, so an endpoint listening for INITIAL_PURCHASE, CANCELLATION, NON_RENEWING_PURCHASE or EXPIRATION gets them too.

Each store payment produces one event, whichever source reports it first: the SDK, a store notification, the subscription refresher or an import.

Verify deliveries

Every delivery carries three headers:

Compute the HMAC over the body exactly as received, before parsing it, and compare in constant time.

// Node.js (Express)
import crypto from "node:crypto";

app.post("/revfox", express.raw({ type: "application/json" }), (req, res) => {
  const expected = "sha256=" + crypto.createHmac("sha256", process.env.REVFOX_WEBHOOK_SECRET).update(req.body).digest("hex");
  const given = req.get("X-Revfox-Signature") ?? "";
  if (given.length !== expected.length || !crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected))) {
    return res.sendStatus(401);
  }
  const { event } = JSON.parse(req.body);
  // handle event.type, ignoring event.id values you have already processed
  res.sendStatus(200);
});

// Go
func verify(body []byte, header, secret string) bool {
	mac := hmac.New(sha256.New, []byte(secret))
	mac.Write(body)
	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
	return hmac.Equal([]byte(header), []byte(expected))
}

Delivery and retries

• Answer with any 2xx within 15 seconds. Anything else, or no answer, is a failure.
• A failed delivery is retried 5 times, after 5, 10, 20, 40 and 80 minutes.
• Every attempt is listed on the webhook's page and on the customer's event page, with the response. Resend there starts a new round of attempts.
• Deliveries can arrive more than once and out of order. Use the event id to skip repeats, and the timestamps rather than arrival order to decide the latest state. When in doubt, read the customer from the server API.

Amplitude and Mixpanel

Integrations → Analytics sends the same events to Amplitude or Mixpanel, through the same delivery, retry and log pipeline. Events are named revfox_<type>, with revfox_trial_started and revfox_refund told apart from other purchases and cancellations. They carry the event's fields as properties and are sent for the customer's ID. Payments and refunds carry revenue, and the event ID is the deduplication ID.