How to use
Requirements
Webhook methods
WhiteBIT withdraw from main balance
Why Webhooks?
Webhooks deliver real-time HTTP notifications when events occur on a WhiteBIT account — deposits arriving, withdrawals completing, codes being applied, and refunds processing. Without webhooks, the only alternative is polling the deposit/withdrawal history endpoints repeatedly. Webhooks vs polling:There is no webhook replay mechanism. If every delivery attempt fails, the event is dropped. Implement polling of the deposit / withdrawal history endpoint as a fallback so events can be reconciled after extended consumer downtime.
- Payment processing — Detect incoming deposits and credit end users automatically
- Withdrawal monitoring — Track withdrawal lifecycle from creation to completion or cancellation
- Code redemption — Receive notification when a WhiteBIT Code is applied
- Refund handling — Detect successful or failed refunds for reconciliation
How to use
- Log in to whitebit.com.
- Open the API keys tab.
- Select the web-hook configuration tab for the API keys.
- Paste the correct URI for the web server to process web-hook calls.
- Press Generate a new key button and toggle the activation switcher to “Activated”.
Requirements
For web hook keys generation
Before using webhooks, verify ownership of the domain set as the webhook destination. Use one of three methods:- Add a TXT DNS record to the domain with the webhook public key.
- Add the plain text file
whiteBIT-verification.txtto the root domain folder and provide public web access. Place the public webhook key in the file. - Implement the
/whiteBIT-verificationendpoint to respond with 200 OK and return a JSON array containing the public webhook key. Example:["<public-webhook-key>"]
For processing web-hook requests
All web hook requests are performing using POST method and with application/json content type. Consumer server should respond with 200 HTTP status code. If the consumer cannot handle the webhook, the platform retries delivery a small number of times spaced roughly an hour apart, over a window of about one day. Treat the exact cadence as best-effort, not a contract, and pair webhook consumption with periodic history polling for reconciliation.Body data
All web-hook requests are performing with- code.apply. Performs when code owned by a customer was applied.
Request headers
Also, all request contains additional data in headers:'Content-type': 'application/json''X-TXC-APIKEY': api_key- the WhiteBIT webhook API key'X-TXC-PAYLOAD': payload'- where payload is base64-encoded body data'X-TXC-SIGNATURE': signature- where signature ishex(HMAC_SHA512(payload), key=api_secret))
WebHook Methods
WhiteBIT code apply
Performed when code was applied. Request example:WhiteBIT deposit to main balance
Performed when deposit was accepted. Request example:Travel Rule deposit statuses (EEA)
For EEA users, an inbound deposit may be frozen pending Travel Rule verification, and the deposit carries a Travel Rule status code (see the table below). There is currently no webhook for these transitions, so track them via the deposit/withdraw history. When the Travel Rule API is enabled for the account, submit the deposit originator data via Submit deposit originator data (POST /api/v4/travel-rule/deposit/verification); otherwise the deposit is verified manually at whitebit.com. Funds are credited only after successful verification.
For details on Travel Rule requirements and the travelRule object for withdrawals, see Regulatory Compliance.
Deposit status codes:
WhiteBIT withdraw from main balance
Performed when withdraw was created. Request example:WhiteBIT refund successful
Triggered after the system successfully completes a refund. Request example:WhiteBIT refund failed
Triggered after the system fails to complete a refund. The system rejects the refund if the destination address does not support the required network or asset, or if validation fails. Use a different address or contact support. Request example:What’s Next
Payment Integration
End-to-end guide for deposit and withdrawal processing with webhook reconciliation.
Security Best Practices
HMAC-SHA512 signature verification, API key management, and production hardening.