Setting Up Webhooks for Auto Result Updates

Polling every 30 seconds works, but it is wasteful — 99% of poll responses are identical to the previous one. Webhooks flip the model: instead of you asking "anything new?", the API pushes new results to your server the moment they are verified. This guide walks through the full setup end-to-end.

What you get

When a result is declared and verified, the API sends an HTTP POST to a URL you control. The payload includes the market slug, the result, and a signature so you can verify the request really came from us (and not someone impersonating us).

Step 1 — Build a webhook receiver

Create an endpoint on your server that accepts a POST with JSON. Here is a minimal Express example:

// server.js
const express = require('express')
const crypto = require('crypto')
const app = express()

app.use(express.raw({ type: '*/*' })) // raw body for signature verification

const WEBHOOK_SECRET = process.env.MATKA_WEBHOOK_SECRET

app.post('/webhooks/matka', (req, res) => {
  // 1. Verify the signature
  const signature = req.headers['x-matka-signature'] || ''
  const expected = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex')

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).json({ error: 'Invalid signature' })
  }

  // 2. Parse the payload
  const event = JSON.parse(req.body.toString())
  console.log('Received event:', event.type, event.data.market.slug)

  // 3. Handle the event
  switch (event.type) {
    case 'result.declared':
      updateBoardInCache(event.data)
      broadcastToConnectedClients(event.data)
      break
    case 'result.verified':
      markVerified(event.data)
      break
    case 'source.down':
      alertOpsTeam(event.data)
      break
  }

  // 4. Always respond 200 quickly
  res.status(200).json({ ok: true })
})

app.listen(3001)

The two non-negotiables:

1. Verify the HMAC signature — without this, anyone can POST fake results to your endpoint.
2. Respond 200 within 5 seconds — if you take longer, the API will time out and retry, leading to duplicate deliveries.

Step 2 — Register the webhook

In your dashboard go to Webhooks → Add Webhook. Provide:

• URL: https://yourdomain.com/webhooks/matka (must be HTTPS, must be publicly reachable).
• Events: pick which events you want — result.declared, result.verified, source.down, source.recovered.
• Secret: this is generated for you. Store it in your server's environment variables.

Alternatively, register via API:

curl -X POST https://sattamatkaapi.live/api/webhooks \
  -H "Authorization: Bearer $MATKA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourdomain.com/webhooks/matka",
    "events": ["result.declared", "result.verified", "source.down"],
    "secret": "'"$MATKA_WEBHOOK_SECRET"'"
  }'

Step 3 — Verify signatures

Every webhook delivery includes a X-Matka-Signature header — an HMAC-SHA256 of the raw request body, using your webhook secret as the key. Verify it on every request, even in development.

The signature comparison MUST be timing-safe (use crypto.timingSafeEqual in Node, hmac.compare_digest in Python). A naive === comparison exposes you to timing attacks.

Step 4 — Handle retries

The API retries failed deliveries with exponential backoff:

| Attempt | Delay | |---|---| | 1 | Immediate | | 2 | +30s | | 3 | +2min | | 4 | +10min | | 5 | +1h | | 6 | +6h |

A delivery is considered "failed" if your endpoint returns a non-2xx status code, takes more than 5 seconds to respond, or drops the connection. After 6 failed attempts, the webhook is marked as failing and you will get an email.

To make retries idempotent, the payload includes an eventId field (a UUID). Track the latest eventId you have processed per webhook and skip duplicates — a retry will resend the same event with the same ID.

const seen = new Set()

app.post('/webhooks/matka', (req, res) => {
  // ... signature verification ...

  const event = JSON.parse(req.body.toString())
  if (seen.has(event.eventId)) {
    return res.status(200).json({ ok: true, deduplicated: true })
  }
  seen.add(event.eventId)

  // ... handle event ...

  res.status(200).json({ ok: true })
})

In production, replace the in-memory Set with a Redis set or a DB table.

Step 5 — Test the webhook

You can send a test event from your dashboard:

curl -X POST https://sattamatkaapi.live/api/webhooks/{id}/test \
  -H "Authorization: Bearer $MATKA_API_KEY"

This sends a fake result.declared event with test: true in the payload. Use it to verify your receiver is reachable and your signature verification works.

Webhook payload shape

{
  "eventId": "evt_abc123",
  "type": "result.declared",
  "createdAt": "2026-08-14T12:29:42.000Z",
  "test": false,
  "data": {
    "market": {
      "slug": "kalyan",
      "name": "Kalyan",
      "session": "day"
    },
    "date": "2026-08-14",
    "openPana": "456",
    "closePana": "123",
    "jodi": "56",
    "resultString": "456-56-123",
    "isComplete": true,
    "verified": true,
    "source": "multi-source-consensus"
  }
}

Common pitfalls

• Forgetting to verify signatures — this is how you get scammed. Always verify.
• Slow handlers — if your handler does heavy work (DB writes, fanning out to WebSocket clients), do it asynchronously. Respond 200 immediately and process the event on a queue.
• HTTP redirects — your endpoint must respond to POST directly. A 307 redirect will cause the API to retry.
• Self-signed certs — the API will not deliver to endpoints with invalid SSL certificates. Use Let's Encrypt or a real CA.
• Localhost URLs — webhooks cannot be delivered to http://localhost. Use a tool like ngrok or stripe-cli-style dev tunnels for local testing.

Summary

Webhooks are the cleanest way to get real-time matka results without the polling tax. Build a receiver that:

1. Verifies the HMAC signature on every request.
2. Handles the event asynchronously (respond 200 within 5s).
3. Deduplicates by eventId.
4. Logs failures so you can debug.

Once your receiver is live, register it via the dashboard or API, send a test event, and you are done. Your server will get a POST the moment any result is declared — no more 30-second polling loop.