> ## Documentation Index
> Fetch the complete documentation index at: https://docs.168992.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

All callback requests are sent as JSON data using the `POST` method.

Our API expects an HTTP Status code 200 for all requests, whether successful or not. All other HTTP status codes are treated as unsuccessful.

## **Request Header**

| Key | Value | Description |
| :- | :- | :- |
| `X-Request-Signature` | `Hash string` | `Signature string issued by our API. ` |
| `Accept` | `application/json` | `Accept: application/json` |
| `Content-Type` | `application/json` | `Content-Type: application/json` |

## **Verifying Callback Request Signature**

The `X-Request-Signature`header is the **Base64-encoded HMAC-SHA512** of the raw HTTP request body. The HMAC key is the UTF-8 bytes of API\_TOKEN.

Sign the body bytes exactly as they were received, before parsing JSON.

```javascript theme={null}
const crypto = require('crypto');

function signature(rawBody, apiToken) {
  return crypto.createHmac('sha512', apiToken)
	.update(rawBody)
	.digest('base64');
}
```

Compare the hash string you generated with the value provided in the `X-Request-Signature` header. If they do not match, it indicates that the request may have been altered or tampered with by a malicious actor.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.