Webhooks Overview

{
  "id": "6f1c2a3b-9d0e-4f7a-8c1b-6e5d3f4a2c9b",
  "type": "trade.completed",
  "apiVersion": "2026-08-19",
  "createdAt": "2026-10-20T12:34:56.789Z",
  "data": { }
}

Content-Type:        application/json
User-Agent:          Kash-Webhooks/1.0
X-Kash-Signature:    t=1792000000000,v1=<hex-hmac-sha256>
X-Kash-Event-Id:     6f1c2a3b-9d0e-4f7a-8c1b-6e5d3f4a2c9b
X-Kash-Event-Type:   trade.completed
X-Kash-Api-Version:  2026-08-19

curl 'https://api.kash.bot/v1/webhooks/events?status=failed&limit=10' \
  -H "X-API-Key: $KASH_API_KEY"

import express from 'express';
import { KashClient, KashWebhookSignatureError } from '@kashdao/sdk';

const app = express();
const kash = new KashClient({ apiKey: process.env.KASH_API_KEY! });

app.post('/webhooks/kash',
  // Verify against the RAW body: re-serialised JSON will not match the signature.
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    let event;
    try {
      event = await kash.webhooks.constructEvent(
        req.body.toString('utf8'),
        req.header('x-kash-signature') ?? '',
        process.env.KASH_WEBHOOK_SECRET!,
      );
    } catch (err) {
      if (err instanceof KashWebhookSignatureError) return res.status(400).send('bad signature');
      throw err;
    }

    if (await alreadyProcessed(event.id)) return res.status(200).send('ok');

    switch (event.type) {
      case 'trade.confirmation-required': /* … */ break;
      case 'trade.completed':             /* … */ break;
      case 'trade.failed':                /* … */ break;
      case 'trade.rejected':              /* … */ break;
    }
    await markProcessed(event.id);
    res.status(200).send('ok');
  },
);