Event DeliveryHMAC-SHA256

Webhooks & Events

Subscribe to real-time events on asset creation, order fulfillment, subscription renewals, and automated wallet spending initiated by MCP AI agents.

Verifying Signatures

Krafto signs every webhook delivery payload with your endpoint secret using HMAC-SHA256. Deliveries include two security headers:

X-Krafto-Signature: Hex-encoded HMAC-SHA256 hash of ${timestamp}.${rawBody}.
X-Krafto-Timestamp: Unix epoch timestamp in seconds when the delivery was dispatched.

import crypto from "crypto";
import { NextRequest, NextResponse } from "next/server";

export async function POST(req: NextRequest) {
  const signature = req.headers.get("x-krafto-signature");
  const timestamp = req.headers.get("x-krafto-timestamp");
  const body = await req.text();

  // Verify HMAC-SHA256 signature
  const expectedSig = crypto
    .createHmac("sha256", process.env.KRAFTO_WEBHOOK_SECRET!)
    .update(`${timestamp}.${body}`)
    .digest("hex");

  if (signature !== expectedSig) {
    return NextResponse.json({ error: "Invalid signature" }, { status: 401 });
  }

  const event = JSON.parse(body);
  console.log("Received Krafto Event:", event.type, event.data);

  if (event.type === "wallet.debited") {
    // Process wallet spending notification
  }

  return NextResponse.json({ received: true });
}

Sample Event Payload

{
  "id": "evt_981240182",
  "type": "wallet.debited",
  "createdAt": "2026-03-13T18:30:00Z",
  "data": {
    "userId": "usr_201948",
    "orderId": "ord_krafto_98210",
    "assetId": "ast_neon_matrix",
    "amountINR": 499,
    "remainingBalanceINR": 1951,
    "initiatedBy": "mcp_tool:purchase_asset_with_wallet"
  }
}

Supported Event Types

asset.publishedFired when a new asset is approved by admins and goes live in catalog.

order.completedFired when a checkout transaction is completed via Razorpay or Card.

wallet.debitedFired when an MCP tool or automated script executes a wallet purchase.

subscription.renewedFired when a monthly tier quota allocation is automatically replenished.

AI Manifests

Error Codes