Zero Hash Webhooks

When to Use This Skill

• How do I receive Zero Hash webhooks?
• How do I verify Zero Hash webhook signatures (x-zh-hook-signature)?
• How do I handle trade_status_changed and payment_status_changed events?
• Why is my Zero Hash webhook signature verification failing?
• How do I guard Zero Hash webhooks against replay attacks with x-zh-hook-timestamp?

Verification (core)

Zero Hash signs the raw request body with HMAC-SHA256 and sends the digest as a hex string. There is no webhook SDK — verify manually.

The recommended (replay-protected) scheme signs payload + timestamp (concatenated raw strings, no delimiter) and sends: