BankBridge receives Plaid webhooks to keep connections, transactions and payments up to date, and can send its own signed webhooks to your other systems.
Incoming Plaid webhooks
- Endpoint:
/wp-json/bankbridge/v1/webhook. Item webhooks are set per connection automatically; also add it as an account-level webhook in the Plaid Dashboard (Identity Verification, Monitor, Transfer and Check use that). - Every request is verified: ES256 JWT signature from Plaid’s key, 5-minute freshness and body SHA-256. Verification is mandatory in Production.
- Events are stored, de-duplicated and processed in the background; failed events can be replayed from BankBridge → Webhooks.
- Handled types include ITEM, TRANSACTIONS, AUTH, HOLDINGS, LIABILITIES, IDENTITY, TRANSFER (events and recurring), IDENTITY_VERIFICATION, ASSETS, SCREENING, LINK, CHECK_REPORT/CRA_REPORT and INCOME.
Outgoing webhooks
BankBridge → Integrations → Outgoing webhooks: add endpoint URLs, pick events, and BankBridge POSTs JSON with retries, a delivery log and one-click redelivery.
| Header | Value |
|---|---|
X-BankBridge-Event | Event name |
X-BankBridge-Delivery | Unique delivery ID |
X-BankBridge-Attempt | Attempt number |
X-BankBridge-Signature | t=<unix>,v1=<hex hmac_sha256("<t>.<body>", secret)> |
Events: item.linked, item.removed, item.status_changed, item.needs_reconnect, transactions.synced, transfer.created, transfer.status_changed, transfer.settled, transfer.failed, transfer.declined, transfer.refunded, idv.status_changed, idv.verified, identity.matched, verification.status_changed, form.bank_submitted, webhook.received.
Verifying a signature
$header = $_SERVER['HTTP_X_BANKBRIDGE_SIGNATURE'];
$body = file_get_contents( 'php://input' );
preg_match( '/t=(\d+),v1=([0-9a-f]{64})/', $header, $m );
$ok = abs( time() - (int) $m[1] ) < 300
&& hash_equals( hash_hmac( 'sha256', $m[1] . '.' . $body, $secret ), $m[2] );Sample payloads: Sample data & downloads.