Webhooks & Events

Overview

Webhooks notify your application in real time when data changes in aYOUne.

Event types

Every entity can trigger three event types: {entity}.created, {entity}.updated, {entity}.deleted.

Payload format

{
  "event": "consumers.created",
  "timestamp": "2026-04-12T16:30:00.000Z",
  "customerId": "5a37a07d...",
  "data": { "_id": "abc123", "first_name": "Anna", ... }
}

Webhook verification Coming Soon

An HMAC-SHA256 signature in the X-aYOUne-Signature header is planned — Stripe-compatible so existing helper libraries can be reused:

X-aYOUne-Signature: t=1714490400,v1=2c8b...e91f

The value is HMAC_SHA256(secret, "{t}.{rawBody}"). Example Node.js verification:

import crypto from 'crypto';

function verifyAyouneSignature(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(
    header.split(',').map((kv) => kv.split('='))
  );
  if (!parts.t || !parts.v1) return false;
  const ageSec = Math.abs(Date.now() / 1000 - Number(parts.t));
  if (ageSec > toleranceSec) return false; // replay window
  const expected = crypto
    .createHmac('sha256', secret)
    .update(parts.t + '.' + rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(parts.v1, 'hex'),
  );
}

Until the header is live, secure your webhook endpoint with a secret query parameter or custom header (e.g. X-Webhook-Secret: …) — the same pattern Stripe / PayPal / SumUp webhooks already use on hooks.ayoune.app.