---
title: "Paddle webhook receiver — HMAC-SHA256 verified, persists raw events"
method: POST
path: "/webhooks/paddle"
tags: ["webhooks"]
---

# Paddle webhook receiver — HMAC-SHA256 verified, persists raw events

`POST /webhooks/paddle`

## Request

- Base URL: `https://api.travelminds.ai`
- URL: `https://api.travelminds.ai/webhooks/paddle`
- Auth: none declared

Verifies the Paddle-Signature header (HMAC-SHA256 of `<ts>:<body>` with PADDLE_WEBHOOK_SECRET), then persists the raw event into tmai_payment_events. The reconciler worker reads from there and maps events to tmai_subscriptions state.

## Headers

- `Paddle-Signature` string, nullable

## Response `200`

Successful Response

- WebhookResponse
  - `received` boolean
  - `event_type` string, required
  - `event_id` string, nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/travelminds/apis/travelmindsai-api-gateway.md) · [All operations](https://skmtc.dev/travelminds/apis/travelmindsai-api-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/travelminds/apis/travelmindsai-api-gateway/revisions/d05c8634e340?raw)