Skip to main content
WEBHOOK

Headers

Timestamp sent by Clink for webhook signature verification.

Hex-encoded HMAC-SHA256 signature generated with the webhook signing secret over the string ${X-Clink-Timestamp}.${rawRequestBody}. Use the raw request body bytes/string exactly as received; do not parse and re-serialize the JSON before verifying.

Signature algorithm used to generate X-Clink-Signature. The current value is SHA256.

Available options:
SHA256

Body

application/json

Order event payload in json

id
string
required

Unique identifier for the event

type
enum<string>
required

Type of event that occurred

Available options:
order.created,
order.next_action,
order.succeeded,
order.failed
object
string
required

Type of this json payload, 'event' if this is an event

Example:

"event"

created
integer<int64>
required

Unix timestamp in milliseconds when the event occurred

data
object
required

Response

200

Return a 200 status to indicate that the data was received successfully.

Account response

Only needed for orders that buy credits on your service, such as a top-up bought through a Skill Marketplace Skill. When order.succeeded arrives for such an order, create or top up the user's account, then return the result in the response body.

An account.reloaded response has the same shape.

  • Commit the account change before you respond. A non-2xx status or a timeout makes Clink retry the event.
  • Deduplicate on the event id. For a repeated delivery, return the stored response without creating another account or applying the top-up again.
  • Clink uses this body only for orders paid through Agent Payment, and makes the result available to the buyer's agent. For other orders and other order events, an empty body is enough.

For the full processing sequence, see Handle Skill payment webhooks.