EventHook Event webhook API

How it will work

1. Create a subscription for any contract event (by address and topics) or for XRC-20 / ERC-20 token transfers (by token, sender or receiver).
2. After 5 confirmations (XDPoS 2.0 finality is about 3 blocks), we will send a JSON POST to your HTTPS endpoint, signed with HMAC-SHA256 in x-notify-signature.
3. Delivery will be at least once: de-duplicate on x-notify-delivery-id (txHash:logIndex). Each delivery will be tried 4 times with backoff, and failed payloads will be kept for 7 days; a replay command is planned.

• Your API key will be stored only as a hash, with per-key rate limits and per-plan subscription limits.
• Only public HTTPS targets will be accepted. Private and loopback addresses will be refused, even if DNS changes later.
• Native XDC transfers are not included yet.

Read-only: we will never ask for your keys or hold funds.

Create a subscription

curl -X POST https://feedplumb.com/notify/subscriptions \
  -H "x-api-key: nk_…" -H "content-type: application/json" \
  -d '{"webhookUrl":"https://example.com/hook",
       "filter":{"erc20Transfer":{"token":"0xFf7412Ea7C8445C46a8254dFB557Ac1E48094391"}}}'

The API answers on this address, but client keys (nk_…) are not issued yet, so this call returns 401 until sign-ups open. The response contains the signing secret once. Store it safely.

Verify the signature (Node.js)

const crypto = require("crypto");
function verify(rawBody, secret, sig) {
  const a = Buffer.from(crypto.createHmac("sha256", secret).update(rawBody).digest("hex"));
  const b = Buffer.from(sig || "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}