ResourcesWebhooks

Real-time Event Notifications

Webhooks allow your application to receive real-time notifications when events occur in your Kite account. Configure endpoints in your dashboard to start receiving events.

Verifying Signatures

Every webhook request includes an X-Kite-Signature header containing an HMAC-SHA256 signature of the payload. Always verify this signature to ensure the request came from Kite.

webhooks.jsjavascript

import crypto from 'crypto';

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  
  const providedSignature = signature.replace('sha256=', '');
  
  return crypto.timingSafeEqual(
    Buffer.from(expectedSignature),
    Buffer.from(providedSignature)
  );
}

// Express.js example
app.post('/webhooks/kite', (req, res) => {
  const signature = req.headers['x-kite-signature'];
  const isValid = verifyWebhookSignature(
    JSON.stringify(req.body),
    signature,
    process.env.KITE_WEBHOOK_SECRET
  );
  
  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // Process the webhook event
  const event = req.body;
  console.log('Received event:', event.type);
  
  res.status(200).json({ received: true });
});

Important: Use timing-safe comparison to prevent timing attacks. Never compare signatures with simple string equality.

Event Catalog

Click on any event to view the example payload structure.

Configure Webhooks

Set up webhook endpoints in your Dashboard → Webhooks section. You can create multiple endpoints and filter which events each receives.