Skip to main content

​
Incoming request authentication

When iklim.co delivers an alarm to your webhook endpoint, it attaches the credentials you configured during alarm registration. The exact mechanism depends on the authentication type you selected:
Auth typeHow credentials are sent
BasicAuthorization: Basic <base64(username:password)> header
API Key — as headerX-API-Key: <your-api-key> header
API Key — as query parameter?apiKey=<your-api-key> appended to the URL
JWTAuthorization: Bearer <jwt-token> header
HMAC SignatureX-Client-Id, X-Signature, X-HmacAlgorithm, X-Timestamp, X-Nonce headers
If you chose API Key authentication, exactly one of the two delivery modes (asHeader or asQueryParameter) is active — never both at the same time.

​
Your endpoint’s response

After receiving an alarm payload, your webhook endpoint must respond with HTTP 200 and a JSON body conforming to the AlarmReceived schema. iklim.co uses both the HTTP status code and the body-level status field to decide whether delivery was successful or should be retried. 
{
  "id": "a1b2c3d4-0000-4e5f-9876-000000000001",
  "status": "SUCCESS",
  "timeEpochMillis": 1726286415123
}