Developer APIs

Generate and manage your API keys for integration.

Loading keys...

Webhook Endpoints

Receive real-time POST notifications when events happen. You can add up to 5 endpoints.

Loading webhooks...

Making API Requests

All API requests to Wicomi must include the following headers for authentication:

Headers: {
  "x-public-key": "wicomi_pk_...",
  "x-secret-key": "wicomi_sk_...",
  "x-transaction-pin": "1234" // Your 4-digit PIN
}

Verifying Webhook Signatures

Every request from Wicomi includes the standardized x-wicomi-signature header (also mirrored in x-signature and verif-hash for integration compatibility). Verify it using HMAC-SHA256:

const crypto = require('crypto');

function verifyWicomiWebhook(req, secret) {
  const signature = req.headers['x-wicomi-signature'] || req.headers['x-signature'] || req.headers['verif-hash'];
  const payloadString = typeof req.body === 'string' ? req.body : JSON.stringify(req.body);
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payloadString)
    .digest('hex');
  return expected === signature;
}