Webhooks

Add an https endpoint in the console. When a bet you recorded settles, we send bet.settled.

{
  "id": "whd_8m2kq0...",
  "type": "bet.settled",
  "created_at": "2026-10-14T19:20:02Z",
  "data": {
    "bet_id": "B-10442", "customer_ref": "cust_4410", "event_id": "rp-tennis-1-3932",
    "market_key": "pt:57", "selection_key": "server", "price": 1.52, "stake": 40,
    "status": "won", "payout": 60.8, "settled_at": "2026-10-14T19:20:01Z",
    "winning_selection": "server", "sandbox": false
  }
}

Verify the signature

Each request has X-RTB-Signature: t={timestamp},v1={signature}. The signature is HMAC SHA-256 of {timestamp}.{raw body} with your endpoint secret. Reject requests older than 5 minutes.

[$t, $v1] = [null, null];
foreach (explode(',', $request->header('X-RTB-Signature')) as $part) {
    [$k, $v] = explode('=', $part, 2);
    $k === 't' ? $t = $v : ($k === 'v1' ? $v1 = $v : null);
}
$expected = hash_hmac('sha256', $t.'.'.$request->getContent(), $secret);
abort_unless(hash_equals($expected, (string) $v1) && abs(time() - (int) $t) < 300, 400);

import hmac, hashlib, time
t, v1 = dict(p.split('=', 1) for p in header.split(',')).values()
expected = hmac.new(secret.encode(), f"{t}.{body}".encode(), hashlib.sha256).hexdigest()
assert hmac.compare_digest(expected, v1) and abs(time.time() - int(t)) < 300

We try each delivery up to 3 times. Answer with any 2xx to acknowledge. Use "Send test event" in the console to check your endpoint.