Integration · Webhooks and data
RevenueDot sends webhooks in RevenueCat's format, so a handler written for RevenueCat keeps working. It accepts all 21 RevenueCat event types as filters and sends 19 of them. Each POST is signed with an HMAC in X-RevenueCat-Webhook-Signature, can carry your Authorization header, and retries 5 times after a failure. Every delivery is logged.
What teams do with it
What RevenueDot sends
POST with Content-Type: application/json and the body {"api_version":"1.0","event":{...}}, with the field names and values of RevenueCat's webhooks.X-RevenueCat-Webhook-Signature: t=<unix seconds>,v1=<hex>, where v1 is the HMAC-SHA256 of <t>.<raw body> keyed with your whsec_ signing secret. It is signed again on every attempt.authorization_header, sent verbatim as the Authorization header. User-Agent is RevenueDot-Webhooks/1.0.TEST, INITIAL_PURCHASE, RENEWAL, CANCELLATION, UNCANCELLATION, NON_RENEWING_PURCHASE, SUBSCRIPTION_PAUSED, EXPIRATION, BILLING_ISSUE, PRODUCT_CHANGE, SUBSCRIPTION_EXTENDED, REFUND_REVERSED, TRANSFER, VIRTUAL_CURRENCY_TRANSACTION, EXPERIMENT_ENROLLMENT, PRICE_INCREASE_CONSENT_REQUIRED, PRICE_INCREASE_CONSENT_APPROVED, PURCHASE_REDEEMED and SUBSCRIBER_ALIAS (opt-in).FUNNEL_VIEWED, FUNNEL_STEP_COMPLETED and FUNNEL_PURCHASE. Only webhooks that name them in event_types get them.Setup
In the dashboard, open Integrations → Webhooks → Add webhook, or call POST /v2/projects/{project_id}/integrations/webhooks.
Enter the url of your endpoint, an optional authorization_header, the environment (production, sandbox or both) and, if you want, event_types and an app_id. Empty event_types means every type except the opt-in ones.
Copy the whsec_ signing_secret. It is shown once, in the answer to the create call, so store it as a secret in your backend.
In your handler, compute the HMAC-SHA256 of <t>.<raw body> with the secret and compare it with v1. Use the raw bytes, not re-serialized JSON.
Return HTTP 200 quickly and ignore events whose event.id you already handled. Click Send test event to receive a signed TEST event.
| Event type | Sent | When it is sent |
|---|---|---|
TEST | Yes | The Send test event button, or POST .../test |
INITIAL_PURCHASE | Yes | First purchase of a chain, paid or trial, and promotional grants |
RENEWAL | Yes | A new period, a resubscription (win-back included), a trial conversion |
CANCELLATION | Yes | Auto-renew off, a billing error, a refund (CUSTOMER_SUPPORT) |
UNCANCELLATION | Yes | Auto-renew back on |
NON_RENEWING_PURCHASE | Yes | One-time purchases |
SUBSCRIPTION_PAUSED | Yes | A Google Play pause is scheduled |
EXPIRATION | Yes | Access ends |
BILLING_ISSUE | Yes | A charge failed |
PRODUCT_CHANGE | Yes | An upgrade, downgrade or crossgrade |
SUBSCRIPTION_EXTENDED | Yes | Apple extend, Google defer, or a longer expiry in the same period |
REFUND_REVERSED | Yes | Apple reversed a refund |
TRANSFER | Yes | A purchase moves to another app user ID |
VIRTUAL_CURRENCY_TRANSACTION | Yes | A product grant credits a balance |
EXPERIMENT_ENROLLMENT | Yes | A customer joins an offering experiment |
PRICE_INCREASE_CONSENT_REQUIRED | Yes | The store asks the customer to accept a higher price |
PRICE_INCREASE_CONSENT_APPROVED | Yes | The customer accepted the higher price |
PURCHASE_REDEEMED | Yes | A web purchase is redeemed in the app with a redemption link |
SUBSCRIBER_ALIAS | Opt-in | A new app user ID joins an existing customer; only webhooks that name it get it |
TEMPORARY_ENTITLEMENT_GRANT | Never | RevenueDot never grants access it has not verified |
INVOICE_ISSUANCE | Never | RevenueDot has no billing engine that issues invoices |
All 21 types are valid in a webhook's event filter. The two marked Never stay filters that never fire.
Hash the raw request body, not parsed JSON. Reject deliveries older than a few minutes so a captured request cannot be replayed.
import { createHmac, timingSafeEqual } from 'node:crypto';
export function verifySignature(rawBody, header, secret, toleranceSeconds = 300) {
const m = /(?:^|,)\s*t=(\d+)\s*,\s*v1=([0-9a-f]{64})\s*(?:,|$)/.exec(header ?? '');
if (!m) return false;
const t = Number(m[1]);
if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
const expected = createHmac('sha256', secret).update(`${t}.`).update(rawBody).digest();
const received = Buffer.from(m[2], 'hex');
return received.length === expected.length && timingSafeEqual(received, expected);
}failed. Each attempt times out after 60 seconds.event.id. Order is not guaranteed.GET /v2/projects/{project_id}/webhooks/{id}/deliveries?status=failed shows each attempt's HTTP status, duration and error. Retry one with POST .../deliveries/{delivery_id}/retry, or use the dashboard.FAQ
The X-RevenueCat-Webhook-Signature header is t=<unix seconds>,v1=<hex>. Compute the HMAC-SHA256 of <t>.<raw body> with your whsec_ signing secret, compare it with v1 in constant time, and refuse a t older than a few minutes. Use the raw request bytes.
19 of RevenueCat's 21 types, including INITIAL_PURCHASE, RENEWAL, CANCELLATION, EXPIRATION and BILLING_ISSUE. TEMPORARY_ENTITLEMENT_GRANT and INVOICE_ISSUANCE are valid filters but never sent. SUBSCRIBER_ALIAS is opt-in.
Yes. The payload shape, field names, signature header and retry schedule follow RevenueCat's webhooks (checked October 2026), so a handler written for RevenueCat works unchanged. Runnable receivers exist for Node.js, Next.js, Python and Go.
5 retries, after 5, 10, 20, 40 and 80 minutes, so 6 attempts in all. Only an HTTP 200 answer counts as delivered. After the last attempt the delivery is marked failed, and you can resend it from the delivery log.
Check the delivery log for the HTTP status of each attempt. Common causes are an answer other than 200, a timeout over 60 seconds, a paused webhook, or an environment or event type filter that excludes the event. See the webhooks not arriving help page.
Sources: RevenueCat: webhooks · RevenueCat: webhook event types and fields. Webhooks is a trademark of its owner, used to describe compatibility. RevenueDot is not affiliated with or endorsed by it.
Get started
Start free on RevenueDot Cloud, free up to $10,000 a month in tracked revenue. Integrations are included on every plan.
Already have an account? Sign in · Prefer your own servers? Self-host free