revolut-webhooks

name	revolut-webhooks
description	Receive and verify Revolut Merchant webhooks. Use when setting up Revolut webhook handlers, debugging Revolut-Signature verification, or handling order and payment events like ORDER_COMPLETED, ORDER_AUTHORISED, or ORDER_PAYMENT_DECLINED.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Revolut Webhooks

When to Use This Skill

• How do I receive Revolut Merchant webhooks?
• How do I verify Revolut webhook signatures (the Revolut-Signature header)?
• How do I handle ORDER_COMPLETED or ORDER_PAYMENT_DECLINED events?
• Why is my Revolut webhook signature verification failing?
• How do I set up a Revolut webhook endpoint via the Merchant API?

Verification (core)

Revolut signs each webhook with HMAC-SHA256 (hex-encoded) using your webhook signing secret (wsk_…, returned when you create the webhook via the Merchant API). There is no official SDK webhook helper, so verify manually.

The signed payload is v1.{Revolut-Request-Timestamp}.{raw body} — period-separated, using the raw request body (re-serialized JSON breaks the signature). The Revolut-Signature header holds v1=<hex> and may carry multiple comma-separated signatures during secret rotation — accept if matches.