# Webhooks

> Direction: Recustomer → Merchant (notification)

Recustomer notifies the endpoint the merchant provides when a return is created or updated, or when a shipping status is updated.

Register each endpoint in the webhook settings of the admin screen, as a pair of an event and a callback URL. Recustomer sends only the events you registered.

## Verifying signatures
Recustomer signs the body of each notification and sends the signature in the X-Recustomer-Signature-256 header. Verify the signature in your endpoint before processing the notification.

1. In the webhook settings of the admin screen, open "Show secret" for the registered webhook to get its signing secret
2. Take the received body as raw bytes, before parsing it as JSON, and compute its HMAC-SHA256 with the signing secret as the key. Encode the result as lowercase hexadecimal and prefix it with `sha256=`
3. Compare the value from step 2 with the X-Recustomer-Signature-256 header using a constant-time comparison. If they don't match, don't process the notification

After you regenerate the secret, later notifications are signed with the new secret.

"Endpoint implementation" on each webhook page has code for these steps.