API
Back to website
Webhooks

Coupon webhooks.

Reloadify can request a coupon from your system in real time — for example when a flow needs a unique discount code for a specific customer. You expose an HTTPS endpoint, and every delivery is signed so you can trust it came from us.

How coupon webhooks work

Configure coupon webhooks on their settings page in your Reloadify account: point them at your HTTPS endpoint. When a coupon is needed, we POST a JSON payload to your URL; respond with a 2xx and the coupon code in the body.

Every request carries a Webhook-Signature header — an HMAC SHA-256 of the raw request body, keyed with your endpoint's signing secret. Verify it before trusting the payload.

Verify signatures

Recompute the HMAC SHA-256 of the raw request body with your signing secret and compare it, in constant time, against the value in the Webhook-Signature header. Reject anything that doesn't match.

Verify a delivery
# Header on every delivery:
Webhook-Signature: 5f8c2e…

# Recompute and compare (pseudocode):
expected = HMAC_SHA256(secret, raw_body)
valid    = constant_time_equal(expected, header_value)
$signature = $_SERVER['HTTP_WEBHOOK_SIGNATURE'] ?? '';
$body      = file_get_contents('php://input');
$expected  = hash_hmac('sha256', $body, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(400);
    exit;
}
import hashlib, hmac

def verify(headers, body: bytes, secret: str) -> bool:
    expected = hmac.new(
        secret.encode(), body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(
        expected, headers.get("Webhook-Signature", "")
    )
require "openssl"

def verify(signature, body, secret)
  expected = OpenSSL::HMAC.hexdigest("SHA256", secret, body)
  Rack::Utils.secure_compare(expected, signature.to_s)
end

Always hash the raw request body, before any JSON parsing or re-serialisation — re-encoding can change bytes and break the signature.

Best practices