Webhooks - Receiving Events
Qwik POSTs an HMAC-signed JSON body to each active, subscribed endpoint when something happens asynchronously. Configure where events are sent via Webhook Management.
Event envelope
Webhook body
{
"id": "stable-idempotency-id",
"type": "Payment.ACH.Completed",
"created_at": "2026-05-25T14:30:00Z",
"data": { /* event-specific fields */ }
}
id is stable per (event, terminal state) - dedupe on it; you may receive the same event twice in edge cases. See the full list of type values in the Webhook Event Catalog.
Delivery headers
| Header | Value |
|---|---|
Content-Type | application/json |
X-Qwik-Event | the event type, e.g. Payment.ACH.Completed |
X-Qwik-Delivery-Id | UUID of the delivery row (cross-reference with …/deliveries) |
X-Qwik-Signature | t=<unix-seconds>,v1=<hmac-sha256-hex> |
User-Agent | Qwik-Webhooks/1.0 |
Always verify the
X-Qwik-Signature header against the raw request body before acting on a webhook.