Event webhook - ER:LC Россия API

The API forwards game server events to your URL. Every request is signed with Ed25519, and your handler must verify the signature.

Setup

Open the webhooks page

Add a URL

Enter your handler address and click “Check”. The API sends two test requests: one with a valid signature and one with a forged one.

Pass the check

The URL is saved only if the handler answers 2xx to the valid request and 4xx to the forged one.

Discord webhook links do not work: you need your own handler.

Handler requirements

Accept POST with a JSON body.
Read the X-Signature-Timestamp (Unix time as a string) and X-Signature-Ed25519 (hex signature) headers.
Verify the signature of timestamp + raw body: the UTF-8 bytes of the timestamp followed directly by the unchanged body bytes.
Answer 2xx only for a valid signature, otherwise 4xx.

Public key

Ed25519, base64, SPKI format:

MCowBQYDK2VwAyEArbRTkyh3A035YUWWZdyF3vck4QN3I7uU8cp7YaxocFE=

Node.js example

import crypto from "node:crypto";
import express from "express";

const publicKey = crypto.createPublicKey({
  key: Buffer.from("MCowBQYDK2VwAyEArbRTkyh3A035YUWWZdyF3vck4QN3I7uU8cp7YaxocFE=", "base64"),
  format: "der",
  type: "spki",
});

const app = express();
app.post("/erlc-webhook", express.raw({ type: "*/*" }), (req, res) => {
  const timestamp = req.get("X-Signature-Timestamp");
  const signature = req.get("X-Signature-Ed25519");
  if (!timestamp || !signature) return res.sendStatus(401);

  const message = Buffer.concat([Buffer.from(timestamp, "utf8"), req.body]);
  const ok = crypto.verify(null, message, publicKey, Buffer.from(signature, "hex"));
  if (!ok) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf8"));
  res.sendStatus(204);
});

Common mistakes:

verifying parsed and re-serialized JSON instead of the raw bytes;
adding a space or separator between the timestamp and the body;
decoding the signature as base64 instead of hex;
the framework consumes the body before you get the raw bytes.

Which events are sent

in-game messages starting with ;, for your own in-game commands;
emergency calls.

More events may be added. Webhooks do not replace the HTTP API or the WebSocket.

​Setup

​Handler requirements

​Public key

​Node.js example

​Which events are sent

Setup

Handler requirements

Public key

Node.js example

Which events are sent