> ## Documentation Index
> Fetch the complete documentation index at: https://developer.sodacards.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Your prepaid wallet was credited



## OpenAPI

````yaml /api-reference/webhooks.yaml webhook wallet.credited
openapi: 3.1.0
info:
  title: SODACARDS Developer API — Webhooks
  version: 1.0.0
  license:
    name: Proprietary
    identifier: LicenseRef-Proprietary
  description: >
    Events SODACARDS sends to a reseller's registered endpoints. Each delivery
    is a POST carrying a signed JSON envelope. Verify the `Sodacards-Signature`
    header before trusting a delivery, and de-duplicate on the event id:
    delivery is at-least-once, so the same event may arrive more than once.


    ## Verifying the signature


    The `Sodacards-Signature` header is `t=<unix-timestamp>,v1=<hex>`, where the
    hex is `HMAC-SHA256(secret, "<t>.<raw-request-body>")` keyed on the
    endpoint's signing secret (shown once at registration, prefixed `whsec_`).
    To verify:


    1. Read the `t` and `v1` values from the header.

    2. Reject the delivery if `t` is more than five minutes from your current
    time
       (replay protection).

    3. Recompute `HMAC-SHA256(secret, t + "." + rawBody)` over the exact raw
    body
       bytes, hex-encode it, and compare it to `v1` in constant time.


    `v1` may carry several comma-separated values during a secret rotation;
    accept the delivery if any one matches.


    A code is never delivered in a webhook: fetch it from the authenticated
    codes endpoint once you receive `order.fulfilled`.
servers:
  - url: https://{your_webhook_endpoint}
    description: Your registered endpoint. SODACARDS POSTs each event here.
    variables:
      your_webhook_endpoint:
        default: hooks.example.com
security:
  - WebhookSignature: []
paths: {}
components:
  securitySchemes:
    WebhookSignature:
      type: apiKey
      in: header
      name: Sodacards-Signature
      description: >
        `t=<unix>,v1=<hex hmac-sha256>` over `"<t>.<raw-body>"`, keyed on the
        endpoint's `whsec_` signing secret. Verify it before trusting a
        delivery.

````