Source type

Coinbase Commerce Source Configuration

Coinbase Commerce sources receive charge and payment webhooks and verify the Coinbase Commerce signature header.

Direct answer

Coinbase Commerce uses X-CC-Webhook-Signature for legacy HMAC-SHA256 body signatures and may use the timestamped X-Hook0-Signature format.

COINBASE_COMMERCEPOST, PUT, PATCH, DELETEShared SecretPayments
Coinbase Commerce documentationAll source types
Coinbase Commerce sends webhook traffic to a FastHook source, FastHook validates the provider contract, records the request, and routes accepted events through connections to destinations.Coinbase CommerceProviderPOST, PUT, PATCH, DELETESignedFastHookSource URLCOINBASE_COMMERCEProvider credentialsignatureVerify before queue401 on auth failure405 on wrong methodAcceptedRequestverified: trueConnections route the accepted request to destinationsFilters, transformations, retries, replay, and destination signatures stay downstream from source verification.

Coinbase Commerce configuration

Create a Coinbase Commerce source, keep POST and PUT and PATCH and DELETE enabled, and provide the configured Shared Secret values for provider signature. FastHook uses these settings to validate each Coinbase Commerce delivery before it enters the routing workflow.

Source Type

COINBASE_COMMERCE

Allowed methods

POST, PUT, PATCH, DELETE

Authentication

Provider signature

Credential fields

Shared Secret

Coinbase Commerce source config
{
  "type": "COINBASE_COMMERCE",
  "config": {
    "auth_type": "PROVIDER_SIGNATURE",
    "auth": {
      "provider": "COINBASE_COMMERCE",
      "webhook_signing_secret": "provider-secret"
    },
    "allowed_http_methods": ["POST","PUT","PATCH","DELETE"]
  }
}

Coinbase Commerce request contract

FastHook verifies x-cc-webhook-signature as HMAC-SHA256 over the raw body, and also supports the timestamped x-hook0-signature form.

POSTPUTPATCHDELETE

Coinbase Commerce headers

Preserve x-cc-webhook-signature, x-hook0-signature when sending Coinbase Commerce test deliveries. FastHook evaluates this request context before accepting the payload, so missing or modified values remain visible as rejected requests instead of routed events.

x-cc-webhook-signature

Legacy HMAC-SHA256 hex signature over the raw body.

x-hook0-signature

Timestamped Hook0-style signature supported by FastHook when present.

Coinbase Commerce setup

  1. Configure the Commerce webhook URL with the FastHook Source URL.
  2. Paste the webhook shared secret into FastHook.
  3. Use the request history to confirm charge state changes before routing fulfillment actions.

Continue with Coinbase Commerce