Bitculator Webhooks API
Bitculator POSTs each event as JSON with an HMAC signature header: X-Bitculator-Signature: t=,v1=.", secret)> X-Bitculator-Event: alarm.triggered Verify it by recomputing the HMAC over "." with your endpoint secret and comparing in constant time; reject if `t` is older than a few minutes (replay guard). Example (PHP): [$t, $v1] = sscanf($_SERVER['HTTP_X_BITCULATOR_SIGNATURE'], 't=%d,v1=%s'); $expected = hash_hmac('sha256', $t.'.'.file_get_contents('php://input'), $secret); abort_unless(hash_equals($expected, $v1) && abs(time() - $t) < 300, 403); Supported events: `alarm.triggered`. Deliveries retry 3× with backoff; an endpoint auto-disables after 10 consecutive failed deliveries.