> ## Documentation Index
> Fetch the complete documentation index at: https://docs.winampay.de/llms.txt
> Use this file to discover all available pages before exploring further.

# Callback Public Key

> Returns the RSA public key used to sign outbound webhook notifications.

Each webhook sent by winam-payments includes an `X-Winam-Signature` header — a JWT RS256 token signed with Winam's private key. Use this endpoint to fetch the corresponding public key for verification.

<Note>
  Cache this response. The key rotates rarely — fetching it on every webhook is unnecessary overhead. A cache TTL of 24 hours is recommended.
</Note>

See [Webhooks](/api-reference/webhooks) for the full signature verification flow with code examples in Python and Node.js.


## OpenAPI

````yaml GET /api/v1/security/callback-public-key
openapi: 3.1.0
info:
  title: Winam Payments API
  description: >

    ## winam-payments — Mobile Money API


    Payment abstraction layer between your **sportsbook or frontend platform**
    and Mobile Money providers in Cameroon (MTN MoMo, Orange Money).


    ### Deposit flow

    1. Your platform calls `POST /api/v1/deposits` with a unique `reference`

    2. winam-payments triggers a USSD collection on the merchant SIM

    3. The player receives a notification on their phone and confirms with their
    PIN

    4. The confirmation SMS is received → transaction `succeeded`

    5. Webhook sent to your `callback_url`


    ### Withdrawal flow

    1. Your platform calls `POST /api/v1/withdrawals`

    2. A Winam operator approves manually

    3. winam-payments sends the USSD transfer

    4. Result webhook sent to your `callback_url`


    ### Authentication

    All requests to `/deposits` and `/withdrawals` must include the header:

    ```

    X-API-Key: <your_api_key>

    ```

    In development (`SPORTSBOOK_API_KEY` empty), authentication is disabled.


    ### Full documentation

    See [docs.winampay.de](https://docs.winampay.de) for the complete public
    documentation with guides, examples, and interactive playground.
  contact:
    name: Eins Innovativ
    email: support@eins-innovativ.de
  version: 0.1.0
servers: []
security: []
tags:
  - name: deposits
    description: >-
      Initiate Mobile Money deposits. The player receives a USSD notification on
      their phone to confirm payment.
  - name: withdrawals
    description: >-
      Initiate Mobile Money withdrawals. Requires manual approval from a Winam
      operator before execution.
  - name: transactions
    description: >-
      Query and manage existing transactions. Use for status polling or incident
      recovery.
  - name: providers
    description: >-
      List available providers and detect the operator from an MSISDN. Use to
      populate payment options in your player interface.
  - name: security
    description: >-
      Public key endpoint for verifying JWT signatures on outbound webhooks.
      Fetch this key once and cache it.
paths:
  /api/v1/security/callback-public-key:
    get:
      tags:
        - security
      summary: Callback verification public key
      description: >-
        Returns the RSA/ECDSA public key used by Winam Payments to sign outbound
        payment notifications. Systems that receive our callbacks must use this
        key to verify the authenticity of each notification.
      operationId: get_callback_public_key_api_v1_security_callback_public_key_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CallbackPublicKeyResponse'
      security:
        - APIKeyHeader: []
components:
  schemas:
    CallbackPublicKeyResponse:
      properties:
        algorithm:
          type: string
          title: Algorithm
          description: JWT signing algorithm used for outbound webhooks
          examples:
            - RS256
        public_key_pem:
          type: string
          title: Public Key Pem
          description: >-
            RSA/ECDSA public key in PEM format. Fetch once and cache — the key
            rotates rarely.
        key_id:
          type: string
          title: Key Id
          description: Key rotation identifier. Changes when the key pair is rotated.
          examples:
            - winam-payments-v1
      type: object
      required:
        - algorithm
        - public_key_pem
        - key_id
      title: CallbackPublicKeyResponse
  securitySchemes:
    APIKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key

````