DRIFTSTACK

Acting as

—

Account settings ·

General

Overview

Developers

API keys
Webhooks

Account

Usage
Billing
Audit log
Team
Privacy & security
Settings

Open admin panel

↑↓ navigate ↵ run esc close

Acting as —. Team access is being verified. Until then, treat this workspace as read-only.

Before you can mint API keys or create sessions, please review and accept the following:

HMAC-SHA256-signed event delivery · 5-minute timestamp tolerance

Webhook endpoints

Subscribe to session lifecycle, egress, challenge, profile-save, payment, and key-revocation events. Each endpoint gets its own signing secret; verify with the SDK's verifyWebhookSignature helper.

Docs

New webhook endpoint

URL

HTTPS required. The endpoint must respond 2xx within 10s for delivery to count as successful.

Events to subscribe to

session.completed session.failed api_key.revoked session.egress_capability_changed crypto.order.paid crypto.order.failed session.challenge_detected session.profile_save_failed

Description (optional)

Endpoint created

Copy this signing secret now — it won't be shown again. Use it with the SDK's verifyWebhookSignature helper to authenticate incoming deliveries.

Signing secret rotated

Copy the new secret now — it won't be shown again. The old secret stays valid for the grace window below; roll your verifier forward before then or the next delivery will fail signature check.

Endpoint

New secret

Old secret valid until

Edit endpoint

URL

Events to subscribe to

session.completed session.failed api_key.revoked session.egress_capability_changed crypto.order.paid crypto.order.failed session.challenge_detected session.profile_save_failed

Description

Active (uncheck to pause delivery without deleting)

No webhook endpoints yet

Subscribe to events when sessions complete, fail, crypto orders settle, or quota thresholds trip. POST + URL + event list = endpoint.

Failed deliveries retry 5× with exponential backoff before landing in the DLQ. DLQ entries are admin-replayable; no auto-retry past the initial attempts to avoid storm-on-recovery patterns.

Driftstack

Privacy Terms DPA AUP Sub-processors