Handler for Tink API webhooks.

Tink sends webhooks for various events like:

• User credentials updated
• Transaction data refreshed
• Account data changed
• Credential errors

Setup

1. Configure webhook secret in your application:

   config :tink, webhook_secret: System.get_env("TINK_WEBHOOK_SECRET")

2. Create a webhook endpoint in your Phoenix app:

   defmodule MyAppWeb.TinkWebhookController do use MyAppWeb, :controller

   def handle(conn, params) do

    signature = get_req_header(conn, "x-tink-signature") |> List.first()
    body = conn.assigns.raw_body  # You need to capture raw body
   
    case Tink.WebhookHandler.handle_webhook(body, signature) do
      {:ok, event} ->
        # Process event
        process_webhook_event(event)
        send_resp(conn, 200, "OK")
   
      {:error, :invalid_signature} ->
        send_resp(conn, 401, "Invalid signature")
   
      {:error, reason} ->
        send_resp(conn, 400, "Bad request: #{reason}")
    end

   end end

3. Register webhook handlers:

   Tink.WebhookHandler.register_handler(:credentials_updated, &handle_credentials_update/1)

Webhook Events

Tink sends the following event types:

• credentials.updated - Credentials were updated
• credentials.refresh.succeeded - Data refresh succeeded
• credentials.refresh.failed - Data refresh failed
• provider_consents.created - Consent was created
• provider_consents.revoked - Consent was revoked

Examples

# Handle webhook in controller
def webhook(conn, _params) do
  signature = get_req_header(conn, "x-tink-signature") |> List.first()
  body = conn.assigns.raw_body

  case Tink.WebhookHandler.handle_webhook(body, signature) do
    {:ok, event} ->
      MyApp.Webhooks.process(event)
      send_resp(conn, 200, "OK")

    {:error, :invalid_signature} ->
      send_resp(conn, 401, "Unauthorized")
  end
end

# Register event handlers
Tink.WebhookHandler.register_handler(:credentials_updated, fn event ->
  # Update user's credential status
  Users.update_credential_status(event["userId"], :updated)
end)

Verification

Webhooks are verified using HMAC-SHA256 signature.