iGrant.io backend webhooks (register + receive + verify)

When to use

Whenever your backend must be notified when a wallet completes an issuance or verification. Pairs with igrantio-backend-sse (which streams the stored events to the browser). Composed by igrantio-issuer-backend / igrantio-verifier-backend.

Before you build: run the integrator intake in igrantio-ows-overview - environment, API key, tenancy, backend host, webhooks, frontend - one question at a time, a recommended default with each.

What it does

• Register (idempotent) - POST /v2/config/webhook with payloadUrl, contentType, subscribedEvents.digitalWalletWebhook, secretKey. Lists existing webhooks first and skips if one already targets the payloadUrl.
• Receive - POST /webhook: verify X-iGrant-Signature: t=<ts>,sig=<hex> where sig = HMAC_SHA256(secretKey, "<t>.<raw body>") (constant-time compare), reject unknown topics, extract the exchange id, store the event.