FastSpring Webhooks

When to Use This Skill

• Setting up FastSpring webhook handlers
• How do I verify FastSpring webhook signatures?
• Why is my X-FS-Signature verification failing?
• Handling order.completed, subscription.activated, or subscription.charge.completed events
• Iterating the batched events array FastSpring delivers in each POST

Verification (core)

FastSpring signs the exact raw request body with HMAC-SHA256 keyed on your per-webhook HMAC SHA256 Secret, base64-encodes the digest, and sends it in the X-FS-Signature header. Pass the raw body (do not parse/re-serialize first), recompute, and compare timing-safe. Each POST batches multiple events in an events array — verify the signature once against the whole body, then iterate.