Developer API ReferenceComing Soon
Webhooks & Signature Verification
Subscribe to real-time events delivered to your server via HTTP POST with cryptographic HMAC-SHA256 signature headers.
API Status: Coming Soon
Buzzeee Outbound Webhooks are currently in private beta and are not yet publicly released. The event schemas and verification methods below represent the planned specification.
Supported Event Types
| Event Name | Description |
|---|---|
| giveaway.winner | Fired immediately when a giveaway draw executes and winner(s) are selected. |
| hunt.opened | Fired when a streamer starts opening bonuses in an active hunt. |
| bet.jackpot | Fired when a tracked casino bet hits a 100x+ or max win multiplier. |
Verifying Webhook Signatures
Every webhook delivery includes an x-buzzeee-signature header formatted as t=<timestamp>,v1=<signature_hex>. Compute the HMAC-SHA256 of t.payload using your webhook signing secret:
Verifying Webhook Signatures
import crypto from 'crypto';
function verifyBuzzeeeSignature(rawBody: string, header: string, secret: string): boolean {
const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
const timestamp = parts['t'];
const expectedSig = parts['v1'];
// Protect against replay attacks (reject payloads > 5 minutes old)
if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
return false;
}
const payload = `${timestamp}.${rawBody}`;
const computedSig = crypto.createHmac('sha256', secret).update(payload).digest('hex');
return crypto.timingSafeEqual(Buffer.from(computedSig), Buffer.from(expectedSig));
}Constant-Time Comparison
Always use timing-safe comparison functions (
crypto.timingSafeEqual or hmac.compare_digest) to protect against timing attacks.