Realtime

Webhooks

Push delivery on addresses, events and onchain conditions, signed, retried, and safe to act on at one confirmation.

One confirmation is enough

Arc finalises on commit, so there is no rollback path to defend against. A webhook at confirmations: 1 can release goods, credit an account or trigger a payout immediately. On a probabilistic chain the same code would need a confirmation buffer and a compensating transaction.

Create

http

POST /v1/$KEY/webhooks
{
  "event": "usdc.transfer",
  "filter": { "to": "0x2c…", "minValue": "100000000" },
  "confirmations": 1,
  "url": "https://api.you.com/hooks/arc",
  "secret": "whsec_…"
}

Events

usdc.transfer, from the de-duplicated feed, so one delivery per movement rather than one per log.
usdc.blocklist, when an address is added to or removed from the blocklist.
cctp.inbound and cctp.outbound, the two legs of a crosschain transfer.
address.activity, any transaction touching a watched address.

Delivery

At-least-once with exponential backoff, HMAC-SHA256 signed, with a 24 hour replay window and a dead letter queue in the dashboard. Deliveries are idempotent on (txHash, logIndex), which is the key to dedupe on if your handler is not already idempotent.

typescript

// verify the signature before trusting the body
import { createHmac, timingSafeEqual } from 'node:crypto'

const sig = req.headers['x-arcrpc-signature']      // t=…,v1=…
const [t, v1] = parse(sig)
const expected = createHmac('sha256', SECRET)
  .update(`${t}.${rawBody}`)
  .digest('hex')

if (!timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) reject()
if (Date.now() / 1000 - Number(t) > 300) reject()     // replay window