Webhooks and XRPC

Signed HTTP webhooks are the default because every app backend can receive them. ATM stores delivery attempts, signs each payload, and lets apps replay failed events from the dashboard.

Delivery is at-least-once but not indefinite: a failing delivery is retried up to 14 attempts with exponential backoff (capped at 24 hours between attempts), keeping it retryable for roughly three days — mirroring Stripe's webhook retry window. After the final attempt the delivery is marked failed and automatic retries stop; fix your receiver, then redrive it from the dashboard delivery log (the redrive keeps the original Atm-Delivery-Id, so idempotent receivers treat it as the same event). If an outage outlasts the window, reconcile from the query endpoints instead of waiting for a webhook that will no longer come.

Apps that already expose a DID-discoverable AT Protocol service can optionally receive events through money.atmosphere.event.receive. This is useful for apps that want their ATM integration to look like the rest of their XRPC surface.

Event payloads include delivery, environment, wire-format version, and event type metadata. The envelope id IS the delivery id — it matches the Atm-Delivery-Idheader — so use it for idempotency. Apps should verify the signature or service-auth envelope before processing the event.

{
  "id": "whd_...",
  "type": "payment.completed",
  "createdAt": "2026-06-05T00:00:00.000Z",
  "apiVersion": "2026-07",
  "environment": "test",
  "data": {
    "$type": "money.atmosphere.event.receive#paymentCompleted",
    "paymentId": "pay_...",
    "amount": 500,
    "currency": "usd",
    "recipientDid": "did:plc:creator"
  }
}

Webhook delivery is at-least-once. Store the delivery id and ATM object id before performing side effects. Redriven events should be safe to receive multiple times.