Webhooks are linked to your MoonPay Commerce account and are authenticated using a
sharedToken — included as both a Bearer token in the Authorization header and as the key for the HMAC signature in the X-Signature header. You can generate your API key in the dashboard. Webhooks are supported for Pay Links on Solana, Ethereum, Base, Polygon, and BTC, as well as Subscriptions on Solana.Webhook Request Headers
Every webhook delivery includes the following HTTP headers:| Header | Description | Included In |
|---|---|---|
Authorization | Bearer <sharedToken> — authenticates that the request originates from MoonPay Commerce. | All webhooks |
Content-Type | Always application/json. | All webhooks |
X-Signature | HMAC-SHA256 hex digest of the request body, keyed with your sharedToken. Use this to verify payload integrity. | Pay Link & Deposit webhooks |
X-Webhook-Delivery-Id | Idempotency key for the webhook delivery, in the format <event>:<key>. | Deposit webhooks only |
X-Transaction-Id | Idempotency key for the underlying transaction. | Deposit webhooks only |
For a step-by-step guide on verifying the
X-Signature header with code examples in Node.js and Python, see Verifying Webhook Signatures in the Webhooks guide.Pay Link Webhook Payload Example
Our webhooks include detailed information about the transaction and Pay Link — for regular Pay Links there is theCREATED event, and for subscriptions there are the STARTED, RENEWED, and ENDED events.
JSON
Deposit Webhooks
We emit three webhook events for deposits:DEPOSIT_TX_SUBMITTED- when the transaction is broadcast to the network, via swaps.xyz when a bridge or swap is involved.DEPOSIT_TX_CONFIRMED- when the transaction is confirmed on the blockchain.DEPOSIT_TX_ENRICHED- when the transaction is enriched with additional data.
DEPOSIT_TX_SUBMITTED Payload Example
JSON
DEPOSIT_TX_CONFIRMED Payload Example
JSON
DEPOSIT_TX_ENRICHED Payload Example
This event includes an incomingTransactions array containing on-chain transaction details. This data can be used to reconcile deposits, track confirmation details, and build reliable transaction histories.
JSON
Authenticating Webhooks with Bearer Token
A unique token generated at webhook creation is included with each webhook request as an Authorization: Bearer SHARED_TOKEN header, verifying that the webhook is sent from us.JSON
Retrieving Geolocation from the Webhook Payload
ThesubmitGeolocation field in the webhook payload provides the ISO 3166-1 alpha-2 country code representing the location of the IP address that initiated the transaction. This field is useful for understanding the geographic source of transactions. See the code example below, taken from the webhook payload
JSON
