Callbacks
How B2BINPAY DeFi delivers invoice and payout callbacks, the payload structure, and how to verify their authenticity
A callback is an outbound HTTP webhook that B2BINPAY DeFi sends to your system when an invoice- or payout-related event occurs. When such an event happens, the app sends a POST request with a JSON body to the callback URL you configured, so you can react to payments and operations in real time.
To inspect delivered callbacks or resend a failed one, open the Callbacks tab of the relevant invoice or payout in the app. Callback inspection and resending are not part of the API key surface.
Callback payload
Every callback body uses the same top-level structure:
id string · UUID
The unique callback identifier, in the UUID format.
type string
The callback type.
Invoice-related types:
INVOICE_CREATED: The invoice was created.INVOICE_DEPOSIT_RECEIVED: An incoming deposit transaction was detected on the invoice address.INVOICE_DEPOSIT_CONFIRMED: The incoming transaction has reached the required number of confirmations.INVOICE_PAID: The paid amount is equal to the requested amount and the invoice status changes to Paid (for invoices with an indicated amount).INVOICE_UNRESOLVED: The paid amount is greater than the requested amount and the invoice status changes to Unresolved (for invoices with an indicated amount).INVOICE_CLAIMED: Funds from the invoice address have been claimed to the account multisig wallet.
Payout-related types:
PAYOUT_CREATED: The payout was created.PAYOUT_SENT: The payout transaction was sent to the blockchain.PAYOUT_EXECUTED: The payout transaction was mined to a block and executed successfully.PAYOUT_CONFIRMED: The payout transaction reached the required number of confirmations.PAYOUT_FAILED: The payout transaction failed in the blockchain.PAYOUT_CANCELLED: The payout was canceled before it was executed.
operation_id string · UUID
The identifier of the original operation: invoiceId for invoice-related callback types, payoutId for payout-related callback types.
operation_type string
The original operation type: invoice or payout.
timestamp string
The date and time the callback was generated, in ISO 8601 format (UTC). Updated with each callback resend attempt.
data object
The callback-specific payload.
Always includes the original operation object (invoice or payout).
May include transactions, claims, and other associated objects.
Below you can find examples of payloads for different callback types.
Callback verification
Each callback request is signed to confirm that it was sent by the B2BINPAY DeFi API and was not modified in transit.
The signature is provided in the X-CALLBACK-SIGNATURE HTTP header, that contains an HMAC-SHA256 hash of the raw JSON payload and your callback secret.
Verification steps
Read the raw request body
Capture the exact HTTP body bytes as received:
- Do not re-serialize the JSON before verification.
- Use
JSON.stringify(payload)without custom replacers/spacing (no pretty print). - Ensure numbers and booleans stay as JSON primitives (do not stringify them).
- Timestamps must be in the UTC ISO 8601 format, for example:
2025-08-22T10:10:00Z.
Read the signature header
Get the value of the X-CALLBACK-SIGNATURE header.
→ If the header is missing, reject the request (HTTP code 400).
Compute the expected signature
Use HMAC with SHA-256:
- Key:
callback_secret(UTF-8) - Message: raw request body bytes (UTF-8)
- Output: hex string
Compare signatures
Compare the received signature with the computed one using a constant-time comparison.
Accept or reject
- If signatures match → process the callback (HTTP code
200). - If they do not match → reject the request (HTTP code
401).
Last updated on