curl --request POST \
--url https://pria.praxislxp.com/api/auth/github/webhook \
--header 'Content-Type: application/json' \
--header 'X-Hub-Signature-256: <x-hub-signature-256>' \
--data '
{
"action": "purchased",
"effective_date": "2023-11-07T05:31:56Z",
"sender": {
"login": "<string>",
"id": 123,
"type": "<string>",
"email": "<string>",
"avatar_url": "<string>"
},
"marketplace_purchase": {
"account": {},
"plan": {},
"billing_cycle": "<string>",
"unit_count": 123,
"on_free_trial": true,
"free_trial_ends_on": "<string>",
"next_billing_date": "<string>"
}
}
'import requests
url = "https://pria.praxislxp.com/api/auth/github/webhook"
payload = {
"action": "purchased",
"effective_date": "2023-11-07T05:31:56Z",
"sender": {
"login": "<string>",
"id": 123,
"type": "<string>",
"email": "<string>",
"avatar_url": "<string>"
},
"marketplace_purchase": {
"account": {},
"plan": {},
"billing_cycle": "<string>",
"unit_count": 123,
"on_free_trial": True,
"free_trial_ends_on": "<string>",
"next_billing_date": "<string>"
}
}
headers = {
"X-Hub-Signature-256": "<x-hub-signature-256>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Hub-Signature-256': '<x-hub-signature-256>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
action: 'purchased',
effective_date: '2023-11-07T05:31:56Z',
sender: {
login: '<string>',
id: 123,
type: '<string>',
email: '<string>',
avatar_url: '<string>'
},
marketplace_purchase: {
account: {},
plan: {},
billing_cycle: '<string>',
unit_count: 123,
on_free_trial: true,
free_trial_ends_on: '<string>',
next_billing_date: '<string>'
}
})
};
fetch('https://pria.praxislxp.com/api/auth/github/webhook', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://pria.praxislxp.com/api/auth/github/webhook",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'action' => 'purchased',
'effective_date' => '2023-11-07T05:31:56Z',
'sender' => [
'login' => '<string>',
'id' => 123,
'type' => '<string>',
'email' => '<string>',
'avatar_url' => '<string>'
],
'marketplace_purchase' => [
'account' => [
],
'plan' => [
],
'billing_cycle' => '<string>',
'unit_count' => 123,
'on_free_trial' => true,
'free_trial_ends_on' => '<string>',
'next_billing_date' => '<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Hub-Signature-256: <x-hub-signature-256>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://pria.praxislxp.com/api/auth/github/webhook"
payload := strings.NewReader("{\n \"action\": \"purchased\",\n \"effective_date\": \"2023-11-07T05:31:56Z\",\n \"sender\": {\n \"login\": \"<string>\",\n \"id\": 123,\n \"type\": \"<string>\",\n \"email\": \"<string>\",\n \"avatar_url\": \"<string>\"\n },\n \"marketplace_purchase\": {\n \"account\": {},\n \"plan\": {},\n \"billing_cycle\": \"<string>\",\n \"unit_count\": 123,\n \"on_free_trial\": true,\n \"free_trial_ends_on\": \"<string>\",\n \"next_billing_date\": \"<string>\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Hub-Signature-256", "<x-hub-signature-256>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://pria.praxislxp.com/api/auth/github/webhook")
.header("X-Hub-Signature-256", "<x-hub-signature-256>")
.header("Content-Type", "application/json")
.body("{\n \"action\": \"purchased\",\n \"effective_date\": \"2023-11-07T05:31:56Z\",\n \"sender\": {\n \"login\": \"<string>\",\n \"id\": 123,\n \"type\": \"<string>\",\n \"email\": \"<string>\",\n \"avatar_url\": \"<string>\"\n },\n \"marketplace_purchase\": {\n \"account\": {},\n \"plan\": {},\n \"billing_cycle\": \"<string>\",\n \"unit_count\": 123,\n \"on_free_trial\": true,\n \"free_trial_ends_on\": \"<string>\",\n \"next_billing_date\": \"<string>\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://pria.praxislxp.com/api/auth/github/webhook")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Hub-Signature-256"] = '<x-hub-signature-256>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"action\": \"purchased\",\n \"effective_date\": \"2023-11-07T05:31:56Z\",\n \"sender\": {\n \"login\": \"<string>\",\n \"id\": 123,\n \"type\": \"<string>\",\n \"email\": \"<string>\",\n \"avatar_url\": \"<string>\"\n },\n \"marketplace_purchase\": {\n \"account\": {},\n \"plan\": {},\n \"billing_cycle\": \"<string>\",\n \"unit_count\": 123,\n \"on_free_trial\": true,\n \"free_trial_ends_on\": \"<string>\",\n \"next_billing_date\": \"<string>\"\n }\n}"
response = http.request(request)
puts response.read_body{
"received": true,
"error": "<string>"
}{
"error": "Invalid signature"
}GitHub Marketplace webhook receiver
Receives marketplace_purchase events from GitHub when an org or user
purchases, upgrades, downgrades, or cancels the Pria Marketplace listing.
The endpoint validates the request via the X-Hub-Signature-256 HMAC header
(computed by GitHub with GITHUB_WEBHOOK_SECRET), then dispatches by action
(purchased, changed, cancelled, pending_change, pending_change_cancelled).
On a new purchase the handler auto-creates the Pria user (via autosignup),
generates a one-time login link (?otp=<base64> in the URL since the link is
delivered by email — see docs/index/oauth-otp.md), and emails it to the
purchaser.
Authentication: none in the traditional sense — request authenticity is
proven by the X-Hub-Signature-256 HMAC, compared with crypto.timingSafeEqual.
Requests with a missing or wrong signature are rejected with 401. Application
errors that occur after signature validation still return 200 so GitHub does
not retry; the failure is surfaced via internal email instead.
curl --request POST \
--url https://pria.praxislxp.com/api/auth/github/webhook \
--header 'Content-Type: application/json' \
--header 'X-Hub-Signature-256: <x-hub-signature-256>' \
--data '
{
"action": "purchased",
"effective_date": "2023-11-07T05:31:56Z",
"sender": {
"login": "<string>",
"id": 123,
"type": "<string>",
"email": "<string>",
"avatar_url": "<string>"
},
"marketplace_purchase": {
"account": {},
"plan": {},
"billing_cycle": "<string>",
"unit_count": 123,
"on_free_trial": true,
"free_trial_ends_on": "<string>",
"next_billing_date": "<string>"
}
}
'import requests
url = "https://pria.praxislxp.com/api/auth/github/webhook"
payload = {
"action": "purchased",
"effective_date": "2023-11-07T05:31:56Z",
"sender": {
"login": "<string>",
"id": 123,
"type": "<string>",
"email": "<string>",
"avatar_url": "<string>"
},
"marketplace_purchase": {
"account": {},
"plan": {},
"billing_cycle": "<string>",
"unit_count": 123,
"on_free_trial": True,
"free_trial_ends_on": "<string>",
"next_billing_date": "<string>"
}
}
headers = {
"X-Hub-Signature-256": "<x-hub-signature-256>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Hub-Signature-256': '<x-hub-signature-256>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
action: 'purchased',
effective_date: '2023-11-07T05:31:56Z',
sender: {
login: '<string>',
id: 123,
type: '<string>',
email: '<string>',
avatar_url: '<string>'
},
marketplace_purchase: {
account: {},
plan: {},
billing_cycle: '<string>',
unit_count: 123,
on_free_trial: true,
free_trial_ends_on: '<string>',
next_billing_date: '<string>'
}
})
};
fetch('https://pria.praxislxp.com/api/auth/github/webhook', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://pria.praxislxp.com/api/auth/github/webhook",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'action' => 'purchased',
'effective_date' => '2023-11-07T05:31:56Z',
'sender' => [
'login' => '<string>',
'id' => 123,
'type' => '<string>',
'email' => '<string>',
'avatar_url' => '<string>'
],
'marketplace_purchase' => [
'account' => [
],
'plan' => [
],
'billing_cycle' => '<string>',
'unit_count' => 123,
'on_free_trial' => true,
'free_trial_ends_on' => '<string>',
'next_billing_date' => '<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"X-Hub-Signature-256: <x-hub-signature-256>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://pria.praxislxp.com/api/auth/github/webhook"
payload := strings.NewReader("{\n \"action\": \"purchased\",\n \"effective_date\": \"2023-11-07T05:31:56Z\",\n \"sender\": {\n \"login\": \"<string>\",\n \"id\": 123,\n \"type\": \"<string>\",\n \"email\": \"<string>\",\n \"avatar_url\": \"<string>\"\n },\n \"marketplace_purchase\": {\n \"account\": {},\n \"plan\": {},\n \"billing_cycle\": \"<string>\",\n \"unit_count\": 123,\n \"on_free_trial\": true,\n \"free_trial_ends_on\": \"<string>\",\n \"next_billing_date\": \"<string>\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Hub-Signature-256", "<x-hub-signature-256>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://pria.praxislxp.com/api/auth/github/webhook")
.header("X-Hub-Signature-256", "<x-hub-signature-256>")
.header("Content-Type", "application/json")
.body("{\n \"action\": \"purchased\",\n \"effective_date\": \"2023-11-07T05:31:56Z\",\n \"sender\": {\n \"login\": \"<string>\",\n \"id\": 123,\n \"type\": \"<string>\",\n \"email\": \"<string>\",\n \"avatar_url\": \"<string>\"\n },\n \"marketplace_purchase\": {\n \"account\": {},\n \"plan\": {},\n \"billing_cycle\": \"<string>\",\n \"unit_count\": 123,\n \"on_free_trial\": true,\n \"free_trial_ends_on\": \"<string>\",\n \"next_billing_date\": \"<string>\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://pria.praxislxp.com/api/auth/github/webhook")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Hub-Signature-256"] = '<x-hub-signature-256>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"action\": \"purchased\",\n \"effective_date\": \"2023-11-07T05:31:56Z\",\n \"sender\": {\n \"login\": \"<string>\",\n \"id\": 123,\n \"type\": \"<string>\",\n \"email\": \"<string>\",\n \"avatar_url\": \"<string>\"\n },\n \"marketplace_purchase\": {\n \"account\": {},\n \"plan\": {},\n \"billing_cycle\": \"<string>\",\n \"unit_count\": 123,\n \"on_free_trial\": true,\n \"free_trial_ends_on\": \"<string>\",\n \"next_billing_date\": \"<string>\"\n }\n}"
response = http.request(request)
puts response.read_body{
"received": true,
"error": "<string>"
}{
"error": "Invalid signature"
}Headers
HMAC-SHA256 of the raw request body, prefixed with sha256=.
GitHub event type. Only marketplace_purchase is acted on; everything else is logged and acknowledged.
Per-delivery UUID assigned by GitHub (for log correlation).
Body
Raw GitHub Marketplace payload. The handler reads req.body as a Buffer and
JSON-parses after signature verification. See GitHub's marketplace_purchase
documentation for the full shape.
Was this page helpful?