Webhook testing - Anchorage Digital

Create your webhook endpoint

Either create your own endpoint or use the Svix playground for rapid testing.Once you have an endpoint, register it via API or the web dashboard:

API: Create a webhook endpoint — use the url field to register the endpoint.
Web dashboard: Create webhooks

List available events and subscribe

API: List webhook event types
API: Create webhook subscriptions — use the endpointId to subscribe to any or all event types.
Web dashboard: Select events

Get validation key

The validation key is used to verify that webhook messages originate from Anchorage Digital. Find it on the web dashboard or via API.Sandbox validation key:

c14b7f3da18abb17b7304f925a68b18c1ea0dad6663b6b54cb67a737ecb77cd0

API: Get webhook validation key

Trigger an event

To test in sandbox, send testnet assets to a wallet, or attempt a withdrawal or transfer via API or the iOS app.For a deposit event:

Generate a new wallet address for BTC Signet (BTC_S) via Postman or the API reference.
Use the BTC Signet Faucet to send testnet BTC to that address.

Receive the webhook message

Once the event fires, your endpoint will receive a message like the following:

{
  "payload": "eyJ0cmFuc2FjdGlvbklkIjoiNjE4Y2JkNTVlNzE2ZmFlMGVkODNjYTcyOWM4MDI2NmEifQ==",
  "timestamp": 1729112450,
  "message_id": "aa2dbc06-1665-44c0-bb8e-d2b0ad15a564",
  "event_type": "deposit.pending-attribution"
}

{
  "payload": "eyJjdXN0b21lcklkIjoiZmJmMzYwOTlkZTMzNmQwMzkyODU0ZmQ5ZTY4NjQxMDcyMjFkYmRhMzBhOWQ1ZWQ4YWI1NWE4ZmZmNTU2NWY3MSIsImFwcGxpY2F0aW9uVHlwZSI6IlJJQV9QQ19JTlNUSVRVVElPTiJ9",
  "timestamp": 1729621585,
  "message_id": "0b136ab6-f837-4de4-9cd8-f8c3c122f443",
  "event_type": "program-customer-onboard.completed"
}

Validate the message signature

Verify the webhook message is from Anchorage Digital using the validation key and the API signature header.You can validate manually or use an open-source tool:Ed25519 signature toolThe Api-Signature header is hex-encoded. Decode it to raw bytes before verifying.

Field	Value
Message encoding	Text (UTF-8)
Message	Paste the raw request body
Key encoding	Hex
Seed (private key)	Leave blank
Public key	Validation key
Signature encoding	Hex
Signature	Paste the `Api-Signature` header value

Decode the payload

The payload field in the response body is Base64-encoded. Decode it to retrieve the event data.Use a Base64 decode tool — paste the payload value into the decode input.

Fetch additional details with the transaction ID

Use the decoded transactionId (or customerId for KYC events) to fetch full details from the API:

List transactions
(RIA only) Get KYC onboarding status