Authentication

Learn how to securely authenticate your server-side requests and verify inbound webhooks.

API Key Header

Every server-side API request is authenticated with your API key sent in the x-api-key header. Use your tri_test_... key while developing and tri_live_... in production.

Header Example

x-api-key: tri_test_9f3a1c7e8b2d4f6a0c1e3b5d7f9a2c4e

Public Resources

Authentication is only required for secret API resources (creating payments, managing webhooks, reading your dashboard). Public, read-only resources — such as fetching the status of a payment by its ID on the hosted checkout — do not require an API key:

No key required

curl -X GET https://tribridge.onrender.com/payments/checkout/<PAYMENT_ID>

Verifying Webhooks

TriBridge signs every webhook it sends using your endpoint's webhook secret (the one returned when you created the endpoint). The signature is delivered in the X-Tribridge-Signature header as sha256=<hmac>. Recompute the HMAC-SHA256 over the raw request body with your secret and compare (using a constant-time check) before trusting the payload.

Verify signature (Node.js)

X-Tribridge-Signature: sha256=9f3a1c7e8b2d4f6a0c1e3b5d7f9a2c4e
X-Tribridge-Timestamp: 2026-08-25T12:00:00.000Z

const crypto = require("crypto");
const expected = crypto
  .createHmac("sha256", WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");
const provided = req.headers["x-tribridge-signature"].replace("sha256=", "");
const ok = crypto.timingSafeEqual(
  Buffer.from(expected), Buffer.from(provided)
);