Skip to content
Developers

Webhooks

Receive HMAC-signed lifecycle events with stable delivery IDs and retries.

Create a destination

Account owners register public HTTP(S) destinations and choose video or subtitle lifecycle events. DNS-aware SSRF validation runs on creation, update, and every queued delivery attempt.

curl -X POST https://www.play.earnloop.online/api/v1/webhooks \
  -H "X-API-Key: baplay_REDACTED" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/hooks/baplay","events":["video.ready"]}'

The HMAC secret is shown once. Store it in a secret manager; BaPlay never renders it again in lists or logs.

Verify a delivery

Compute HMAC-SHA256 over timestamp + "." + raw_json_body with the endpoint secret, then compare against X-BaPlay-Signature using a constant-time function. Reject old timestamps and duplicate delivery IDs.

$signed = $timestamp.'.'.$rawBody;
$expected = hash_hmac('sha256', $signed, $secret);
$valid = hash_equals($expected, $receivedSignature);

Retry policy

Deliveries use three attempts with 30, 300, and 3,600 second backoffs. Logs retain status, duration, success, and a sanitized error—never credentials, destination secrets, request payloads, or response bodies.