Last updated June 29, 2026
Setup
Create and manage endpoints from /account/webhooks. Endpoints must use HTTPS, subscribe only to needed event types, and support retry-safe processing. Use /docs for API reference details.
API
Webhook guide
Webhook event setup, signing, timestamp tolerance, replay protection, retries, test delivery, and secret rotation.
Signing model
Each delivery should include an event id, timestamp, and signature. Verify the signature with the active endpoint signing secret, enforce timestamp tolerance, reject old deliveries, and store event ids for replay protection before processing side effects.
if (!VerifySignature(headers, body, signingSecret)) return 401;
if (!WithinTimestampTolerance(headers.Timestamp)) return 401;
if (AlreadyProcessed(headers.EventId)) return 200;
ProcessEvent(body);Retries, test delivery, and rotation
Return a 2xx response only after durable processing. Temporary 5xx errors can be retried. Permanent validation errors should be fixed in configuration. Use rotate signing secret from the customer webhook page after exposure, staff changes, or integration migration. Use test delivery before enabling production events.