Know when
something changes.
BINK POSTs a signed JSON event to your endpoint whenever something happens on the rail — a payment completes, a payout settles, a refund finishes. Verify the signature, react, no polling.
{
"type": "payment.completed",
"data": {
"id": "pay_8f2a1c",
"reference": "BINK-8F2A1C",
"status": "PAID",
"amountMinor": "5000",
"currency": "EGP"
}
}HTTP/1.1 200 OKThe real payload shape and headers from the reference. Display and copy only.
From event to acknowledged.
An event fires
Something happens on the rail — a payment completes, a payout settles.
BINK POSTs it
A signed JSON body is delivered to the endpoint you registered.
You verify it
Recompute the HMAC over {timestamp}.{raw body} and compare to v1.
You handle it
Switch on the event type and update your system — idempotently.
You return 200
Acknowledge receipt. Non-2xx responses are retried with backoff.
Signed with HMAC-SHA256.
Every delivery carries X-Binkpay-Signature in the form t=<timestamp>,v1=<hmac>, with the type in X-Binkpay-Event. Recompute the HMAC over {timestamp}.{raw body} with your secret and compare.
import crypto from 'crypto';
function verifySignature(rawBody, header, secret) {
const [tPart, v1Part] = header.split(',');
const timestamp = tPart.split('=')[1];
const signature = v1Part.split('=')[1];
const expected = crypto
.createHmac('sha256', secret)
.update(`${timestamp}.${rawBody}`)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(expected),
Buffer.from(signature),
);
}Thirteen events you can subscribe to.
payment.createdA payment or payment link was created.payment.completedA payment was successfully captured.payment.expiredA payment link expired before being paid.payment.cancelledA pending payment was cancelled.
refund.createdA refund request was submitted.refund.completedA refund finished and funds returned.
payout.requestedA payout was requested, awaiting approval.payout.approvedA payout was approved and queued.payout.completedA payout settled to your bank account.payout.failedA payout attempt failed.payout.rejectedA payout request was rejected.
kyb.status_changedYour business verification status changed.apikey.revokedAn API key was revoked.
A non-2xx response is retried with exponential backoff, and any past delivery can be replayed from the dashboard — see the reference for the retry window.
Continue the journey.
Bring BINK events into your system.
Register an endpoint, verify the signature, and react to state changes as they happen.