Webhooks

How it works

In hosted mode, your agent doesn’t run a server. When someone deposits a secret or a magic link is verified, the platform forwards the event to your webhook URL.

Configure

atomic config set webhook-url https://your-api.com/atomic/events

Deposit webhook

When a secret is deposited:

{
  "event": "deposit.received",
  "label": "stripe-key",
  "value": "sk_live_abc123...",
  "source_ip": "142.93.12.45",
  "timestamp": "2026-03-10T14:30:00Z"
}

Magic link webhook

When a magic link is verified:

{
  "event": "magic_link.verified",
  "code_hint": "abc1...6789",
  "timestamp": "2026-03-10T14:31:00Z"
}

Security

Webhook payloads are signed with your agent’s private key. Verify the X-Agent-Sig header on incoming webhooks the same way you’d verify any signed request.

Retry policy

Failed deliveries (non-2xx response) are retried 3 times with exponential backoff: 10s, 60s, 5m.