---
title: "Paddle Webhook"
method: POST
path: "/webhooks/paddle"
---

# Paddle Webhook

`POST /webhooks/paddle`

## Request

- Base URL: `https://api.elaan.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.elaan.io/webhooks/paddle`
- Auth: none declared

Verify the signature, normalize the event, and reconcile it onto the
tenant's subscription. Returns 200 for anything verified (even events we
ignore) so Paddle doesn't redeliver; an unverifiable signature raises → 400.
The transactional route commits before responding.

The raw body goes to the verifier undecoded — the HMAC covers exactly these
bytes, and a body that isn't UTF-8 is the verifier's 400 to raise, not an
unhandled decode error on an anonymous endpoint.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.dev/elaan/apis/elaan-api.md) · [All operations](https://skmtc.dev/elaan/apis/elaan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaan/apis/elaan-api/revisions/c96a7e6399aa?raw)