# Webhooks

Section: API
Page: https://docs.konecto.ltd/api/webhooks

Signed events for orders, refunds, check-ins and pages.

Konecto sends signed POST requests to your endpoints and retries with backoff for up to 72 hours.

| Event | When |
| --- | --- |
| order.paid | A checkout completed and tickets were issued |
| order.refunded | An order was fully or partly refunded |
| attendee.registered | A free registration was completed |
| ticket.checked_in | A ticket was scanned at the door |
| event.published | An event was published |
| event.updated | Event details changed |
| event_page.published | The event page was published |
| module.enabled | A module was enabled |

## Payload
``json
{
  "id": "evt_2Lm...",
  "type": "order.paid",
  "created": "2026-11-14T18:02:11Z",
  "data": { "order": { "id": "ord_91x", "event": "acme-summit", "total": 4000, "currency": "gbp", "tickets": 2 } }
}
`

## Verify the signature
Each request has a Konecto-Signature header: t=<timestamp>,v1=<hex HMAC-SHA256 of "timestamp.body"> with your endpoint secret. Reject requests older than five minutes.

`ts
import crypto from 'node:crypto';

export function verify(body: string, header: string, secret: string) {
  const [t, v1] = header.split(',').map((p) => p.split('=')[1]);
  const expected = crypto.createHmac('sha256', secret).update(t + '.' + body).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(t)) < 300;
  return fresh && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}
``