API & Webhooks

Authentication

API keys are issued per company. The secret is shown only once when the key is created, so store it safely. Send both values as headers on every request.

curl https://YOUR_API_HOST/v1/... \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-api-secret: YOUR_API_SECRET"

API keys are available on request during onboarding. Never expose them in a browser or mobile app.

Webhooks

Add an endpoint in Settings → Integrations → Webhooks, choose the events you want (or all of them), and send a test event from the same screen.

Available events

• invoice.created
• invoice.paid
• invoice.overdue
• invoice.voided
• payment.received
• payment.failed
• dispute.opened
• dispute.resolved
• activity.completed

Delivery

• Each delivery is a JSON POST with the headers X-Reimber-Event (the event name) and X-Reimber-Signature.
• Respond with any 2xx status within 10 seconds.
• Failed deliveries are retried up to 5 times with exponential backoff (2, 4, 8, 16 and 32 seconds).

Verifying the signature

import crypto from 'node:crypto';

// rawBody: the exact request body as received (string or Buffer)
function isValidReimberSignature(rawBody, signatureHeader, webhookSecret) {
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', webhookSecret).update(rawBody).digest('hex');
  return (
    signatureHeader.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected))
  );
}