# feat.press webhooks

feat.press sends signed JSON to the HTTPS endpoint you configure on an app product when entitlements change.

## Headers

- `feat-signature: t=<unix_seconds>,v1=<hex>`
- `feat-event-id`: idempotency id (same as payload `id`)

## Verification

Compute HMAC-SHA256 of `${t}.${rawBody}` with your webhook secret and compare to `v1` in constant time. Reject timestamps older than 300 seconds with HTTP 400. Duplicates must return 200 without side effects.

## Event types

`webhook.test`, `entitlement.activated`, `entitlement.renewed`, `entitlement.updated`, `entitlement.cancellation_scheduled`, `entitlement.past_due`, `entitlement.expired`, `entitlement.revoked`.

Payload shape: `{ id, type, apiVersion, createdAt, data }`.

Official SDK: `@feat-press/node`.

Index: https://www.feat.press/developers