A webhook arrives, you verify the signature, you fetch the document — and the API answers 404. Nothing is missing: you are reading a sandbox document with a production key. Each environment only sees its own documents, and until now the payload never said which one it was about.
The gateway now stamps the answer at the root of every new outgoing webhook, and SDK 5.6.0 ships the matching type:
import { webhooks } from "@getpeppr/sdk";
const event = await webhooks.constructEvent(rawBody, signatureHeader, secret);
const keys = { sandbox: SANDBOX_KEY, production: LIVE_KEY } as const;
// Absent means "not yet known" — keep whatever fallback you already use.
const apiKey = event.environment ? keys[event.environment] : FALLBACK_KEY;
Compatibility. The field is optional by contract: events emitted before
this change, test.ping, and not-yet-resolved status events carry none.
Absence never means "production by default". Event ids, signatures,
deduplication and retries are unchanged; some families also keep the same
value inside data.environment for compatibility.
npm install @getpeppr/sdk@5.6.0
Full contract on the webhooks documentation page.