Skip to main content

Start using

Prepare endpoint​

Your endpoint must be an HTTPS address with a valid SSL certificate that can correctly process requests.

Subscribe to a webhook topic​

You can subscribe to a webhook using Growave API (2.0).

Receive the webhook​

Each time an event occurs, Growave sends an HTTP POST request to the specified URL. The HTTP POST request's parameters contain JSON data relevant to the event that triggered the request.

Verify the webhook​

Before handling a webhook message, you need to verify that the webhook was sent from Growave. You can verify the webhook by calculating a signature that was sent on headers.

Each webhook request includes base64-encoded X-Growave-Hmac-Sha256 header. The signature is generated using your API secret. To find your API credentials, navigate to Settings → API in the Growave admin panel.

Here is example code in PHP how to verify a webhook. If the calculated HMAC and the X-Growave-Hmac-Sha256 header value match, the webhook was sent by Growave.

<?php

define('API_SECRET', env('API_SECRET'));

function verifyWebhook($data, $hmacHeader)
{
  $calculatedHmac = base64_encode(hash_hmac('sha256', $data, API_SECRET, true));
  return hash_equals($calculatedHmac, $hmacHeader);
}

function getRequestBody()
{
    return file_get_contents('php://input');
}

$hmacHeader = $_SERVER['HTTP_X_GROWAVE_HMAC_SHA256'];
$isVerified = verifyWebhook(getRequestBody(), $hmacHeader);

if ($isVerified) {
    # Process webhook payload
    # ...
}

Manage your webhooks​

After receiving a webhook message via HTTPS, it's important to respond within 1–2 seconds.

Prepare your endpoint for a burst of requests. As a general template for webhook processing, it is recommended to separate the processing of the webhook message from responding to the request. You can store the webhook message in a message queue for later processing by a background worker.