REAL-TIME EVENT STREAM
HMAC-SHA256 Signed Webhook Infrastructure
Synchronize your backend, billing systems, Discord communities, and analytics with real-time license lifecycle events. Every payload is cryptographically signed with HMAC-SHA256 signatures to prevent replay attacks.
HMAC-SHA256 Signatures
Verify incoming payloads with the X-NineAuth-Signature header. Never process unauthenticated requests.
Exponential Backoff Retries
If your receiving endpoint encounters temporary downtime, NineAuth retries deliveries up to 5 times automatically.
Comprehensive Event Types
Listen for license.activated, license.revoked, hwid.reset, session.created, and more.
Verifying Webhook Signatures in Node.js / Express
TypeScript / Node.jswebhook-handler.ts
HMAC-SHA256 Verificationimport crypto from "crypto";
export function verifyNineAuthWebhook(
rawBody: string,
signatureHeader: string,
webhookSecret: string
): boolean {
const computedSignature = crypto
.createHmac("sha256", webhookSecret)
.update(rawBody)
.digest("hex");
return crypto.timingSafeEqual(
Buffer.from(signatureHeader),
Buffer.from(computedSignature)
);
}