Verify the signature, always
Every request carries a Syntra-Signature header computed over the timestamp and the raw body. Reject anything that does not verify, and reject timestamps older than five minutes.
Webhooks
Syntra posts a signed event to your endpoint as each payout changes state. Retries run for 24 hours, and every event can be replayed from the dashboard.
Delivery
POST https://your-app.com/hooks/syntra
Syntra-Signature: t=1773504062,v1=5a3f...c81b
{
"id": "evt_2Pq8Lm",
"type": "payout.settled",
"created_at": "2026-03-14T16:41:02Z",
"data": {
"id": "po_4471QxD",
"status": "settled",
"reference": "March payroll",
"received": "1612.90",
"destination_currency": "USD"
}
}import crypto from "node:crypto";
export function verify(rawBody, header, secret) {
const [ts, sig] = header.split(",");
const timestamp = ts.split("=")[1];
const expected = crypto
.createHmac("sha256", secret)
.update(timestamp + "." + rawBody)
.digest("hex");
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(sig.split("=")[1]),
);
}Event types
Handling rules
Every request carries a Syntra-Signature header computed over the timestamp and the raw body. Reject anything that does not verify, and reject timestamps older than five minutes.
Return a 2xx within ten seconds and queue the work. If we do not get a 2xx we retry with backoff for 24 hours.
A retry can arrive after you already processed the event. Deduplicate on the event id rather than assuming exactly-once delivery.
Apply in under ten minutes. Most businesses are verified within one working day and send their first payout the day after.