Your API key is missing, invalid, or tied to the wrong entity. Make sure you are sending the key in X-API-Key and that the key belongs to the server or bot you are querying.
The request rate is too high. Cache repeated reads, back off for a few seconds, and avoid calling the API from every message when one cached response would do.
Webhook endpoints must be public HTTPS URLs. Localhost, private subnets, and other internal destinations are rejected so Rankly does not become an SSRF proxy.
Check that the URL is saved correctly, the endpoint is publicly reachable, and the test webhook succeeds. If the endpoint returns a non-2xx response or times out, fix that first.
For server monetization webhooks, verify the X-Webhook-Signature header against the raw request body and your webhook secret. If signature verification fails, do not activate premium access.
Treat deliveries as at-least-once and deduplicate by orderId plus event. Your handler should be idempotent so replays do not double-grant entitlements.
These lifecycle events are sent only for recurring server plans. Check that the purchased tier is weekly/monthly (not lifetime), auto-renew is enabled, and your endpoint returns 2xx quickly.
Immediately remove premium entitlement and mark the order as revoked in your system. Revoked events usually indicate dispute/chargeback handling and should override normal active state.
Credits can be denied for normal reasons such as captcha failure, ad blocker detection, a server that is too new, or a server that does not meet the minimum member count. The webhook payload includes the denial reason.