Developers
An open platform, inside the product
API keys, webhooks, an API tester and SDK samples all live in Scriwo. No separate developer portal, no waiting for access.
Scoped API keys
Create a key per integration with only the access it needs. Revoke one without breaking the others.
Signed webhooks
Receive events as they happen. Every delivery is signed so you can verify it came from Scriwo.
API tester and SDKs
Try any request from inside the product, then copy working samples into your code.
Verifying a webhook
Each delivery carries X-Scriwo-Timestamp and X-Scriwo-Signature headers. The signature is an HMAC-SHA256 of the timestamp, a dot, and the raw body, using your webhook secret:
// Verify a Scriwo webhook before trusting it (Node.js / Express)
import crypto from "node:crypto";
// rawBody: the exact request body text, before JSON parsing.
export function isFromScriwo(rawBody, headers, secret) {
const timestamp = headers["x-scriwo-timestamp"];
const given = String(headers["x-scriwo-signature"] || "");
const expected = crypto
.createHmac("sha256", secret)
.update(`${timestamp}.${rawBody}`)
.digest("hex");
const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300;
return fresh && given.length === expected.length &&
crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected));
}Building an integration?
Tell us what you want to connect. We will make sure your plan includes API access and help you get started.