treezor-webhooks

name	treezor-webhooks
description	Receive and verify Treezor webhooks. Use when setting up Treezor webhook handlers, debugging signature verification, or handling BaaS banking events like payin.create, payout.update, cardtransaction.create, wallet.create, or user.kycreview.
license	MIT
metadata	{"author":"hookdeck","version":"0.1.0","repository":"https://github.com/hookdeck/webhook-skills"}

Treezor Webhooks

When to Use This Skill

• How do I receive Treezor webhooks?
• How do I verify the Treezor object_payload_signature?
• Why is my Treezor webhook signature verification failing?
• How do I handle Treezor events like payin.create, cardtransaction.create, or user.kycreview?
• How do I subscribe to Treezor webhooks via the API?

Verification (core)

Treezor uses a custom HMAC-SHA256 scheme — not Standard Webhooks — and the signature is a field inside the JSON body, not an HTTP header. Webhooks arrive with a text/plain MIME type, so parse the body yourself.

Each body carries object_payload (the object data) and object_payload_signature. To verify, re-serialize object_payload to Treezor's canonical form (the same string PHP's json_encode produces): . Then HMAC-SHA256 it with your , base64-encode, and compare timing-safe.