[
/docs
·
Webhooks
]
Verifying webhook signatures
Check that an event really came from Sluice before acting on it.
group
Webhooks
Each request carries a Sluice-Signature header with a timestamp and an HMAC-SHA256 of the raw body, signed with your endpoint’s secret.
Use sluice.webhooks.verify(body, header, secret) in the SDK, or compute the HMAC yourself over timestamp.body. Reject requests older than five minutes to block replays.
Rotate the secret from the dashboard at any time. During rotation, Sluice signs with both the old and new secret for 24 hours.
[ example request ]
Node
Python
cURL
connect
import { Sluice } from ‘@sluice/node’;
const sluice = new Sluice(process.env.SLUICE_KEY);
const session = await sluice.connect.sessions.create({
user: ‘user_31c’,
scopes: [‘balances’, ‘transactions’],
});
// send session.url to your user
201 Created · 84 ms
id cs_7Hq2
url https://connect.sluice.dev/cs_7Hq2
expires_in 900
[
→
·
more guides
]
Next on the list.
Sluice® Template
$129 · one-time
NOVA STUDIO
/ SECURED BY POLAR