# Invoice paid (/api/webhooks/invoice-paid)

Webhook event `invoice:paid`, sent as `POST` to your subscription's URL.

Fires when a payment on the invoice succeeds and the order is made. The payment may still be `pending` (for example an authorization not yet captured); wait for `invoice:payment_completed` when you need the money taken. The body is an event object with the invoice in `data`.

## Parameters

- `X-Comecero-Signature` (header): Proof the delivery comes from Comecero and was not changed. It is the HMAC-SHA256 of the raw request body (UTF-8), keyed with the signature key as UTF-8, written as 64 lowercase hex characters. The key is the event subscription's `signature_key`, or the account's signature key (Settings, Technical) when the subscription has none. Every account gets one when it is created, so deliveries are signed unless the key was removed. To check it, compute the HMAC over the body exactly as received, before you parse it, and compare the two strings in constant time. Reject the delivery when they differ. The signature has no timestamp, so to guard against a replayed delivery also skip any `event_id` you already handled. If you cannot check signatures, use the event only as a hint: get the object by its id from the API before you act on it.
- `User-Agent` (header): Always `Comecero-Event (+https://comecero.com)`.

Responses: 200.

Full schemas: operation `event_invoice_paid` in /openapi.json.