GitHub Start free

What does the RevenueDot webhook event VIRTUAL_CURRENCY_TRANSACTION mean?

The RevenueDot webhook event VIRTUAL_CURRENCY_TRANSACTION means a customer was credited with an in-app currency.

Quick facts#
Event VIRTUAL_CURRENCY_TRANSACTION
Where RevenueDot webhook (event.type), RevenueCat's webhook format
Sent to Every enabled webhook whose filters match
Fields that are specific to it source
What it means An in-app currency was credited because a purchase of a granting product was recorded (source: in_app_purchase), or because a rewarded ad was verified and a reward rule granted currency (source: ad_reward, a RevenueDot extension). Not sent for adjustments made through the API.

When it is sent#

  • A purchase of a product that grants currency was recorded (source: in_app_purchase).
  • A rewarded ad was verified and a reward rule granted currency (source: ad_reward). For that source, product_id and store are null.
  • Adjustments you make through the API do not send it.

What your server should do#

  1. Credit the currency once, keyed on event.id or the transaction ID.
  2. Branch on source if you treat ad rewards differently from purchases.
  3. Do not treat it as revenue: the purchase has its own event.
  4. Deduplicate on event.id: deliveries can repeat, because anything but HTTP 200 is retried after 5, 10, 20, 40 and 80 minutes.

Example#

JavaScript
import { createHmac, timingSafeEqual } from "node:crypto";

// X-RevenueCat-Webhook-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">
function verify(rawBody, header, secret, toleranceSeconds = 300) {
  const m = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header ?? "");
  if (!m || Math.abs(Date.now() / 1000 - Number(m[1])) > toleranceSeconds) return false;
  const expected = createHmac("sha256", secret).update(`${m[1]}.${rawBody}`).digest();
  return timingSafeEqual(expected, Buffer.from(m[2], "hex"));
}

// Sign a sample delivery the way RevenueDot does, then handle it.
const secret = "whsec_test_secret";
const rawBody = JSON.stringify({ api_version: "1.0", event: {"id":"66339910-3BFF-49F4-B873-D1283D673DE2","type":"VIRTUAL_CURRENCY_TRANSACTION","app_user_id":"user_1","product_id":"pro_monthly","source":"in_app_purchase"} });
const t = Math.floor(Date.now() / 1000);
const header = `t=${t},v1=${createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex")}`;

const seen = new Set(); // use a database table in production

function handle(rawBody, header) {
  if (!verify(rawBody, header, secret)) return "401 bad signature";
  const { event } = JSON.parse(rawBody);
  if (seen.has(event.id)) return "200 duplicate";
  seen.add(event.id);
  if (event.type !== "VIRTUAL_CURRENCY_TRANSACTION") return "200 ignored";
  return "credit the currency once, source " + event.source;
}

console.log(handle(rawBody, header));

Run-checked: npm run check:snippets runs this snippet with Node and compares its output with source in_app_purchase (checked 2026-10-03).

How RevenueDot produces it#

recordRawEvent records it from services/virtual-currencies.ts when a granting purchase is applied, and from the ad reward service when a reward callback is verified. It uses its own field set: the common fields plus the currency fields.

Source#

Checked: 2026-10-03

Edit this page on GitHub ↗ View as Markdown Last updated