Install & uninstall hooks

Install

When a merchant installs your integration, Bito POSTs an authorization code to your redirect_uri. No user redirect is involved — this is a server-to-server call.

What Bito sends you

POST https://your-app.example.com/bito/installed
Content-Type: application/json
X-Bito-Signature: t=1736937000,v1=6b1f0a...c94e

{
    "code": "abc123def456",
    "client_id": "69c50a2d50f7b939923a469b",
    "account_id": "507f1f77bcf86cd799439011"
}

Verify the request came from Bito

Both the install and uninstall POSTs carry an X-Bito-Signature: t=<unix seconds>,v1=<hex> header, where v1 = HMAC_SHA256(client_secret, "{t}.{raw_body}") over the exact body. Recompute it, compare in constant time, and reject stale (t more than ~5 minutes old) requests. See Install flow → Verify the request really came from Bito for the full explanation and a code example.

Exchange that code for tokens within 20 minutes — see calling the API. Store the resulting tokens against the account_id.

Uninstall

When a merchant removes your integration, Bito POSTs to your revoke_access_hook_uri.

What Bito sends you

POST https://your-app.example.com/bito/revoked
Content-Type: application/json
X-Bito-Signature: t=1736937000,v1=6b1f0a...c94e

{ "account_id": "507f1f77bcf86cd799439011" }

This POST is signed exactly like the install one — verify the X-Bito-Signature header before trusting it.

Delete or deactivate everything you hold for that account. Its tokens are already dead on Bito's side.

WARNING

Uninstalling deletes every webhook your integration owns in that account. If the merchant reinstalls later, the webhook_uri subscription is re-created automatically, but destinations you added with webhook/subscribe must be subscribed again.

A reinstall does not issue a new signing secret: webhooks are signed with your client secret (client_secret), which changes only when you rotate it.