Webhooks
Receive a notification in your system for every key generated, HWID reset or balance change.
Instead of polling the API, your system can receive notifications: on every event, our server sends a POST with a signed JSON to the URL you register.
How to register
In the panel, under Notificações e logs (Notifications and logs), each channel accepts one URL:
- A Discord webhook URL: the channel receives a ready-made message, formatted for Discord.
- Any other
httpsURL: your system receives the JSON described on this page.
The same screen has the Test button, the delivery history and each channel's secret, used to validate the signature.
Channels
| Channel | When it notifies | Events |
|---|---|---|
keys | You generated keys (through the API or the panel). | key.generated |
hwid | An HWID was reset. | key.hwid_reset |
credits | Your balance changed: purchase or adjustment. | credits.purchased, credits.added, credits.removed |
mods | A changelog was published for a reseller mod. | changelog.published |
games | The game of a reseller mod was updated. | game.updated |
On the mods and games channels you can choose, in the panel, which mods or games you want to hear about. With no choice, you receive all of them.
URL requirements
https, on the default port (443), at a public address. Internal network addresses are refused.- No username or password in the URL. To know the notification came from us, validate the signature.
- Answer
2xxwithin 5 seconds. Ideally204with no body; a response over 1 MB counts as a failure. - Redirects are not followed: register the final URL.
Headers
| Header | What it is |
|---|---|
Content-Type | application/json |
X-Project-Event | The event (same as the event field). |
X-Project-Delivery | The notification id (same as the id field). Identical on a retry. |
X-Project-Timestamp | When it was sent, in seconds since 1970 (Unix). |
X-Project-Signature-256 | sha256= followed by the hex HMAC-SHA256 of "{timestamp}.{body}" with the channel secret. |
Body
Every notification has the same envelope; what changes is the data of each event.
{
"id": "6f1c2a4e-9d3b-4e7a-8c51-2b0d9f7a1e33",
"event": "key.generated",
"channel": "keys",
"version": 1,
"created_at": "2026-10-15T14:03:00-03:00",
"data": {
"generation_id": 57,
"product": { "id": 1001, "title": "MOD EXEMPLO" },
"quantity": 1,
"days": 30,
"keys": [{ "id": 204496, "code": "0a1b2c3d…c9d0e1f" }],
"credits": { "spent": 18, "balance": 480 },
"reseller": { "id": 12, "login": "mystore" }
}
}| Field | What it is |
|---|---|
id | The unique notification id. Use it to ignore repeats. |
event | The event (table below). |
channel | The channel that received it. |
version | The envelope format version. Currently 1. |
created_at | When the event happened (ISO 8601). |
data | The event data. |
Events
| Event | Fields in data |
|---|---|
key.generated | generation_id, product {id, title}, quantity, days, keys [{id, code}], credits {spent, balance}, reseller {id, login} |
key.hwid_reset | key {id, code}, reseller {id, login} |
credits.purchased | order_id, credits, balance, reseller {id, login} |
credits.added | amount, balance, reseller {id, login} |
credits.removed | amount, balance, reason, reseller {id, login} |
changelog.published | product {id, title, image}, changelog {id, items [], text_pt, text_en} |
game.updated | game {appid, name, version, link, image}, products [{id, title}] |
webhook.test | message, reseller {id, login} — sent by the Test button in the panel. |
In notifications, keys come masked (the start and end of the code). The full key comes from the API: List your keys, with the id from keys[] in user_ids[].
Responses and failures
| Your response | What happens |
|---|---|
2xx | Delivered. |
3xx or 4xx (except 429) | Failure. The notification is not resent. |
5xx, 429 or no response within 5 seconds | Failure. The notification may be resent a few times, with the same id. |
Every failure shows up in the delivery history in the panel.
After 10 failures in a row, the channel is disabled. Fix your server and save the URL again in the panel to re-enable it.
Next step
Validate the signature of every notification before trusting it.