Webhooks

Needs the webhooks scope. Krexa signs each event with Standard Webhooks.

Add an endpointCopy Anchor Link

POST https://api.krexa.xyz/api/v1/partner/webhooks
X-API-Key: kxp_…
Content-Type: application/json

{ "url": "https://your.app/krexa/webhook", "events": ["backtest.completed", "agent.trade"] }

The answer holds a whsec_… secret. You see it one time. Other routes: GET /webhooks, DELETE /webhooks/:id, POST /webhooks/:id/rotate, POST /webhooks/:id/test.

EventsCopy Anchor Link

backtest.completed · research.completed · agent.started · agent.trade · agent.paused · agent.stopped · agent.limit_hit

Check the signatureCopy Anchor Link

Use the raw body. Do not parse and re-serialize it first.

import { verifyKrexaWebhook } from '@krexa-xyz/sdk';

app.post('/krexa/webhook', async (req) => {
  const raw = await req.text();
  const event = verifyKrexaWebhook(raw, req.headers, process.env.KREXA_WHSEC!); // throws if bad
  // event.type, event.data
  return new Response(null, { status: 204 });
});

It checks webhook-signature in constant time and rejects a webhook-timestamp older than 5 minutes. Use webhook-id to drop repeats: Krexa retries a failed delivery up to 6 times over about one day. Answer 2xx fast.