Event Webhooks

Documentation Index

Fetch the complete documentation index at: https://apidocs.erlc.gg/llms.txt

Use this file to discover all available pages before exploring further.

​

Event webhooks

1. Open your private server settings.
2. Search for Event Webhook.
3. Paste an HTTPS URL that can receive JSON POST requests.

​

Requirements

​

Your endpoint must accept

• POST requests with a JSON body
• These headers on every signed request:
  • X-Signature-Ed25519 (hex-encoded Ed25519 signature)
  • X-Signature-Timestamp (Unix timestamp string)

​

Your endpoint must:

1. Read the raw request body bytes exactly as received (do not re-serialize JSON).
2. Read X-Signature-Timestamp.
3. Read X-Signature-Ed25519.
4. Verify the signature over: ( message = timestamp + raw_body ) Where timestamp is the header value as a string, concatenated directly with the raw body bytes.
5. Return:
   • 2xx only if the signature is valid
   • 4xx if headers are missing, malformed, or signature verification fails

​

Public key

MCowBQYDK2VwAyEAjSICb9pp0kHizGQtdG8ySWsDChfGqi+gyFCttigBNOA=

​

Implementation Details

​

Inputs

• timestamp: the exact string from X-Signature-Timestamp
• sigHex: the exact string from X-Signature-Ed25519 (hex)
• rawBody: raw request bytes

​

Steps

1. Decode sigHex from hex to bytes.
2. Build message as:
   • bytes of timestamp in UTF-8
   • followed immediately by rawBody
3. Verify Ed25519 signature using the public key above.

​

Common pitfalls

• Do not use a parsed JSON object when verifying. You must use the raw body.
• Do not add separators or whitespace between timestamp and body.
• Treat the signature as hex, not base64.
• Ensure your framework does not auto-consume the body before you capture it.

​

What events are sent?

• Messages starting with ;
  • This allows your integration to create custom in-game commands!
• Emergency Calls