Rewards and webhooks

When a user becomes eligible for a reward, the Platform presents the claim action. Onward validates the claim and asks the configured Reward Provider to deliver the reward.

Provider responsibilities

• Expose an HTTPS webhook endpoint.
• Verify the webhook signature before parsing or applying the request.
• Use the raw request body when calculating the signature.
• Enforce timestamp freshness to prevent replay attacks.
• Make reward delivery idempotent.
• Return quickly and perform slow downstream work asynchronously when possible.
• Log delivery identifiers without recording secrets.

Signature verification

The existing integration uses an HMAC-SHA256 signature with a timestamp. The signed value is constructed from the timestamp and exact raw JSON body:

Code
HMAC-SHA256(webhook_secret, "<timestamp>.<raw_json_body>")

Use constant-time comparison and reject stale timestamps. A five-minute tolerance is a sensible default unless your integration agreement specifies another value.