React to events
the moment they happen.

1. Visitor lands on your site 2. Client SDK calls prynt.identify() 3. Prynt processes identification & runs rules 4. Prynt sends HTTP POST to your webhook endpoint 5. Your server receives the event payload 6. Your server responds with 200 OK 7. Process event asynchronously (log, alert, block, etc.) Client ──> Prynt API ──> Your Webhook Endpoint identify() process POST /webhooks/prynt │ └── rules engine, ML scoring, signals

curl -X POST https://api.prynt.io/v1/webhooks \ -H "Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxx" \ -H "Content-Type: application/json" \ -d '{ "url": "https://yourapp.com/webhooks/prynt", "events": [ "identification.complete", "verdict.block", "verdict.challenge", "rule.matched" ], "description": "Production fraud alerts", "enabled": true }'

import crypto from 'crypto'; import express from 'express'; const app = express(); const WEBHOOK_SECRET = process.env.PRYNT_WEBHOOK_SECRET; // IMPORTANT: Use raw body for signature verification app.use('/webhooks/prynt', express.raw({ type: 'application/json' })); function verifyWebhookSignature(req) { const signature = req.headers['x-prynt-signature']; const timestamp = req.headers['x-prynt-timestamp']; // Reject requests older than 5 minutes (replay protection) const age = Math.abs(Date.now() / 1000 - parseInt(timestamp)); if (age > 300) { throw new Error('Webhook timestamp too old'); } // Compute expected signature const payload = `${'${'}timestamp}.${req.body}`; const expected = 'sha256=' + crypto .createHmac('sha256', WEBHOOK_SECRET) .update(payload) .digest('hex'); // Timing-safe comparison to prevent timing attacks if (!crypto.timingSafeEqual( Buffer.from(signature), Buffer.from(expected) )) { throw new Error('Invalid webhook signature'); } return true; } app.post('/webhooks/prynt', (req, res) => { try { verifyWebhookSignature(req); } catch (err) { console.error('Webhook verification failed:', err.message); return res.status(401).json({ error: 'Invalid signature' }); } const event = JSON.parse(req.body); console.log('Verified event:', event.eventType, event.eventId); // Respond 200 immediately, process async res.status(200).json({ received: true }); // Process the event asynchronously processWebhookEvent(event).catch(console.error); });

import { Queue } from 'bullmq'; const webhookQueue = new Queue('prynt-webhooks'); app.post('/webhooks/prynt', async (req, res) => { // 1. Verify signature (see Section 5) verifyWebhookSignature(req); const event = JSON.parse(req.body); // 2. Check idempotency — skip if already processed const alreadyProcessed = await redis.get(`wh:${'${'}event.idempotencyKey}`); if (alreadyProcessed) { return res.status(200).json({ skipped: true }); } // 3. Mark as received await redis.set(`wh:${'${'}event.idempotencyKey}`, '1', 'EX', 86400); // 4. Respond immediately res.status(200).json({ received: true }); // 5. Queue for async processing await webhookQueue.add(event.eventType, event, { jobId: event.eventId, removeOnComplete: 1000, removeOnFail: 5000, }); });

import express from 'express'; import crypto from 'crypto'; const app = express(); const SLACK_WEBHOOK_URL = process.env.SLACK_WEBHOOK_URL; const WEBHOOK_SECRET = process.env.PRYNT_WEBHOOK_SECRET; app.use('/webhooks/prynt', express.raw({ type: 'application/json' })); async function sendSlackAlert(event) { const { data } = event; const emoji = event.eventType === 'verdict.block' ? '🛑' : '⚠️'; const message = { blocks: [ { type: 'section', text: { type: 'mrkdwn', text: `${'${'}emoji} *Prynt Alert: ${'${'}event.eventType}*`, }, }, { type: 'section', fields: [ { type: 'mrkdwn', text: `*Visitor:*\n\`${'${'}data.visitorId}\`` }, { type: 'mrkdwn', text: `*IP:*\n${'${'}data.ip}` }, { type: 'mrkdwn', text: `*Location:*\n${'${'}data.geo.city}, ${'${'}data.geo.country}` }, { type: 'mrkdwn', text: `*Suspect Score:*\n${'${'}data.scores.suspect}/100` }, { type: 'mrkdwn', text: `*Verdict:*\n${'${'}data.verdict}` }, { type: 'mrkdwn', text: `*Bot Detected:*\n${'${'}data.signals.bot.detected}` }, ], }, { type: 'actions', elements: [{ type: 'button', text: { type: 'plain_text', text: 'View in Dashboard' }, url: `https://prynt.id/app/event-detail?id=${'${'}data.requestId}`, }], }, ], }; await fetch(SLACK_WEBHOOK_URL, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(message), }); } app.post('/webhooks/prynt', (req, res) => { verifyWebhookSignature(req); // see Section 5 const event = JSON.parse(req.body); // Respond immediately res.status(200).json({ received: true }); // Send Slack alert for block and alert events only if (['verdict.block', 'alert.triggered'].includes(event.eventType)) { sendSlackAlert(event).catch(console.error); } }); app.listen(3000, () => console.log('Webhook server running on :3000'));

# List all webhooks prynt webhooks list # View delivery history for a specific webhook prynt webhooks deliveries wh_3kR8mNqT7xP2v --limit 20 # Inspect a specific delivery attempt (headers, body, response) prynt webhooks inspect del_x9K2mNpR7jT3q # Send a test event to your endpoint prynt webhooks test \ --url https://yourapp.com/webhooks/prynt \ --event identification.complete # Retry all failed deliveries for the past 24 hours prynt webhooks retry wh_3kR8mNqT7xP2v --since 24h # Stream webhook deliveries in real time (tail -f style) prynt webhooks stream wh_3kR8mNqT7xP2v