📥Event Webhook

Event webhooks

To receive event webhooks from the game:

1. Open your private server settings.

2. Search for Event Webhook.

3. Paste an HTTPS URL that can receive JSON POST requests.

   1. Optionally, you can add ?long=true to the end of your webhook URL to have the game send longer requests with type information.

Your endpoint must verify Ed25519 signatures on every request. The game will only save webhook URLs that pass our validation check.

---

Requirements

Your endpoint must accept

• POST requests with a JSON body

• These headers on every signed request:

  • X-Signature-Ed25519 (hex-encoded Ed25519 signature)

  • X-Signature-Timestamp (Unix timestamp string)

Your endpoint must:

1. Read the raw request body bytes exactly as received (do not re-serialize JSON).

2. Read X-Signature-Timestamp.

3. Read X-Signature-Ed25519.

4. Verify the signature over:

   ( message = timestamp + raw_body )

   Where timestamp is the header value as a string, concatenated directly with the raw body bytes.

5. Return:

   • 2xx only if the signature is valid

   • 4xx if headers are missing, malformed, or signature verification fails

---

Public key

Use this Ed25519 Public key (base64, SubjectPublicKeyInfo / SPKI):

MCowBQYDK2VwAyEAjSICb9pp0kHizGQtdG8ySWsDChfGqi+gyFCttigBNOA=

---

Implementation Details

Inputs

• timestamp: the exact string from X-Signature-Timestamp

• sigHex: the exact string from X-Signature-Ed25519 (hex)

• rawBody: raw request bytes

Steps

1. Decode sigHex from hex to bytes.

2. Build message as:

   • bytes of timestamp in UTF-8

   • followed immediately by rawBody

3. Verify Ed25519 signature using the public key above.

Common pitfalls

• Do not use a parsed JSON object when verifying. You must use the raw body.

• Do not add separators or whitespace between timestamp and body.

• Treat the signature as hex, not base64.

• Ensure your framework does not auto-consume the body before you capture it.

---

What events are sent?

Currently, the game will send a webhook for:

• Messages starting with ;

  • This allows your integration to create custom in-game commands!

• Emergency Calls

More events may be added in the future. Please note: the webhook system is not intended to replace polling the HTTP APIs.