Drop developers

Webhooks

Configure a webhook in the Drop portal to receive delivery updates. Verify the signature against the exact raw request body before processing an event.

Endpoint

POST https://api.dropsa.co.za/v1/webhooks/test

Required scope

webhooks:manage

Important delivery headers

text

x-drop-event: delivery.status.updated
x-drop-event-id: evt_01HXYZ...
x-drop-timestamp: 1711111111
x-drop-signature-version: v1
x-drop-signature: t=1711111111,v1=<hex_hmac_signature>

Example event payload

json

{
  "id": "evt_01HXYZ...",
  "type": "delivery.status.updated",
  "created_at": "2026-06-22T12:15:22.431Z",
  "data": {
    "delivery_id": "delivery_01HXYZ...",
    "status": "driver_assigned"
  }
}

Node.js verification

const expected = crypto
  .createHmac("sha256", process.env.DROP_WEBHOOK_SECRET)
  .update(`${timestamp}.${rawBody}`)
  .digest("hex");

if (!crypto.timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(signature, "hex"))) {
  throw new Error("Invalid Drop webhook signature");
}

Implementation notes

Process events idempotently by x-drop-event-id.
Reject signatures outside the replay window and use the raw body, not a re-serialized object.
Return a successful response quickly; handle longer delivery workflows asynchronously.