Webhooks

Webhooks let you receive instant notifications whenever something happens in the Pinch system. When an Event occurs, Pinch sends an HTTP POST request to the URI you configured when creating the Webhook.

All Webhook payloads follow a common structure. See the Events page for the full list of Event types and their specific payloads.

{
  "Id": "evt_XXXXXXXXXXXXXXXX",
  "Type": "event-type-name",
  "EventDate": "2026-04-10T12:34:56.789Z",
  "Metadata": { },
  "Data": { }
}

📘

During development, you can use https://webhook.site/ to inspect incoming Webhook requests from Pinch in real time.

Verifying webhooks

By default, your Webhook endpoint is publicly accessible — anyone can send a POST request to it, not just Pinch. You must verify every incoming request to ensure it genuinely came from Pinch.

When you create a Webhook, Pinch returns a secret value (format: whsec_...). Pinch includes a pinch-signature header on every delivery that looks like this:

pinch-signature: t=1619577772,v2=e5db053264a6657a563bf7a9e1ec18bb914b816663ea0e2f8deca9edc876a4g

• t= — the Unix timestamp of when the request was sent
• v2= — an HMAC-SHA256 signature of {timestamp}.{request body} using your Webhook secret

To verify the signature manually:

1. Extract t and v2 from the pinch-signature header.
2. Construct the signed payload string: {t}.{raw request body}.
3. Compute HMAC-SHA256({signedPayload}, webhookSecret).
4. Compare your computed value to v2. If they match, the request is genuine.
5. Check that t is within an acceptable time window (the .NET SDK uses 5 minutes by default) to protect against replay attacks.

If you are using the .NET SDK, call VerifyWebhook() — it handles all of the above for you. See WebhookClient.cs for the full implementation.

Webhook Formats

Webhooks can be delivered in two JSON formats:

1. PascalCase (default):

{
  "Id": "evt_XXXXXXXXXXXXXXXX",
  "EventDate": "2026-04-10T12:00:00.000Z",
  "Data": { }
}

2. camelCase:

{
  "id": "evt_XXXXXXXXXXXXXXXX",
  "eventDate": "2026-04-10T12:00:00.000Z",
  "data": { }
}