Webhooks

Webhooks overview

Webhooks tell your server when a payment moves forward: the sender joined, the auditor approved, the transaction number arrived. No need to ask again and again.

How it works

Register an endpoint
A public HTTPS address on your server, with the events it wants, or * for all. Up to 5 endpoints per account. See Register an endpoint.
El-B sends each event
As a POST with a JSON body, signed with the endpoint's secret.
Your server answers 2xx
Within 5 seconds. Answer first, then do the work in the background. Anything else is retried.

A delivery

POST /elb/webhooks HTTP/1.1
Host: shop.example.com
Content-Type: application/json
User-Agent: El-B-Webhooks/1.0
X-ElB-Event: payment.reference_submitted
X-ElB-Delivery: 0199c1e9-3b4d-7f20-a1c6-5e7f8a9b0c1d
X-ElB-Signature: sha256=5c1f0e…

{"id": "0199c1e9-…", "event": "payment.reference_submitted", "created_at": "2026-11-02T10:24:37+01:00", "data": {…}}

Header	Meaning
`X-ElB-Event`	The event's name.
`X-ElB-Delivery`	The delivery's id: the same in every retry. Keep the ids you handled to ignore a repeat.
`X-ElB-Signature`	`sha256=` and the HMAC-SHA256 of the body. See Signature verification.

Good to know

Events are sent only while an endpoint listens to them: register before you need them.
Deliveries can arrive out of order. Compare created_at, or read the payment with Get a payment before acting.
Redirects are not followed, and addresses that lead to private networks are refused.
A paused endpoint receives nothing until you resume it.