Skip to main content
Deprecation noticeWebhooks v1 was deprecated on June 15, 2026. If your integration still relies on v1, it is at risk: v1 no longer receives fixes or enhancements, issue resolution is not guaranteed, and the service may be fully retired at any time without prior notice. Fireblocks is not responsible for missed or delayed notifications or any disruption resulting from continued use of Webhooks v1. Upgrade to Webhooks v2 now via the Developer Center in the Fireblocks Console. For upgrade steps and event mapping, see the Webhooks v2 Migration Guide.
Fireblocks sends events to your webhook endpoint URL(s) associated with the workspace, as part of a POST request with a JSON payload.

Validation

You can validate Fireblocks webhook events by validating the signature attached in the request header: Fireblocks-Signature: Base64(RSA512(_WEBHOOK_PRIVATE_KEY_, SHA512(eventBody))) To validate the signature in Production workspaces, please use the public key below:
To validate the signature in EU and EU2 workspaces, use the public key below:
To validate the signature in Sandbox workspaces, please use the public key below:

Check event objects

Each event is structured as an object with a type and a data sub-object that holds the transaction ID, as well as other related information. Your endpoint must check the event type and parse the payload of each event. Example: transaction created webhook
Example: transaction status updated webhook

Response

The Fireblocks server will look for a response to confirm the webhook notification was received. All webhook events should receive an HTTP 200 (OK) response. If no response is received, Fireblocks will resend the 5xx request several more times. The retry schedule (in seconds) is 5, 15, 35, 75, 155, 315, 635, 1275, 2555 for webhooks v1. For webhooks v2, the retry schedule (in seconds) is 0, 30, 120, 300, 900, 1800, 3600, 7200, 14400.