order.completed
Every item fulfilled — fetch the codes via the authenticated checkout endpoint.
Authorizations
API key (wg_live_…) created in the dashboard (Account → API Keys).
Shown once at creation; only a hash is stored server-side.
Headers
t=<unix-ms>,v1=<hmac-sha256-hex> — up to two v1 entries during the 24 h secret-rotation window. HMAC is over "<t>.<raw body>".
payment.detected, payment.confirmed, order.completed, order.partial, order.failed, refund.initiated, refund.completed, refund.failed Delivery id (whd_…) — stable across retries; use as your idempotency key.
Body
Delivery id (whd_…) — your idempotency key; stable across retries.
"whd_Xy12Ab34Cd56"
Event type (WebhookEventType or ping).
"order.completed"Unix timestamp in milliseconds (UTC).
1753142400000
Order snapshot. NEVER contains card codes — fetch those via the authenticated GET.
Response
Acknowledged.