Skip to main content
Deprecation noticeWebhooks v1 has been in soft deprecation since June 15, 2026: it receives no fixes or enhancements, and issue resolution is not guaranteed. Starting October 5, 2026, v1 is being shut down permanently in phases, with all workspaces affected by October 28, 2026. Once shut down, v1 stops delivering notifications and cannot be restored. Fireblocks is not responsible for missed or delayed notifications or any disruption resulting from continued use of Webhooks v1. Upgrade to Webhooks v2 now via the Developer Center in the Fireblocks Console. For upgrade steps and event mapping, see the Webhooks v2 Migration Guide.
Fireblocks sends events to your webhook endpoint URL(s) associated with the workspace, as part of a POST request with a JSON payload.

Validation

You can validate Fireblocks webhook events by validating the signature attached in the request header: Fireblocks-Signature: Base64(RSA512(_WEBHOOK_PRIVATE_KEY_, SHA512(eventBody))) To validate the signature in Production workspaces, please use the public key below:
To validate the signature in EU and EU2 workspaces, use the public key below:
To validate the signature in Sandbox workspaces, please use the public key below:

Check event objects

Each event is structured as an object with a type and a data sub-object that holds the transaction ID, as well as other related information. Your endpoint must check the event type and parse the payload of each event. Example: transaction created webhook
Example: transaction status updated webhook

Response

The Fireblocks server will look for a response to confirm the webhook notification was received. All webhook events should receive an HTTP 200 (OK) response. If no response is received, Fireblocks will resend the 5xx request several more times. The retry schedule (in seconds) is 5, 15, 35, 75, 155, 315, 635, 1275, 2555 for webhooks v1. For webhooks v2, the retry schedule (in seconds) is 0, 30, 120, 300, 900, 1800, 3600, 7200, 14400.