Core ConceptEvent Engine
Webhooks & Retries
Webhooks notify your backend services in real-time when critical security, billing, or licensing events occur. Every delivery is cryptographically signed with HMAC-SHA256 and backed by a 5-stage exponential retry queue.
Core Webhook Events
license.activated— User bound a new machine to their license.license.expired— License hit its validity termination timestamp.license.revoked— Operator or automated rule revoked the license.device.hwid_reset— A hardware fingerprint reset was executed.billing.subscription.renewed— CashinPay PIX payment confirmed renewal.
HMAC-SHA256 Signature Verification
Every outgoing HTTP POST includes a x-nineauth-signature header computed over the raw request payload using your application's webhook signing secret:
verify-webhook.ts
import crypto from "crypto";
export function verifyWebhook(rawPayload: string, signature: string, secret: string): boolean {
const expected = crypto
.createHmac("sha256", secret)
.update(rawPayload, "utf8")
.digest("hex");
return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}Exponential Backoff Retry Schedule
If your destination server returns any non-2xx status code or times out, NineAuth queues deliveries with 5 exponential backoff attempts:
- Attempt 1: Immediate
- Attempt 2: +1 minute
- Attempt 3: +5 minutes
- Attempt 4: +30 minutes
- Attempt 5: +2 hours