Set up your endpoint
1
Register an endpoint
Call
POST /webhooks with a public HTTPS URL.Your endpoint should return a 2xx response promptly. Move any longer processing to your own queue, so slow work doesn’t cause delivery timeouts.2
Store the signing key
POST /webhooks returns a public_key. Store it securely. If you lose it, you can recover it with GET /webhooks.3
Verify every request
Before accepting an event, verify the timestamp and signature headers against the raw request body. Parse the body only after verification succeeds, because re-serialized JSON won’t match the signature.
4
Process events idempotently
Use the event
id as an idempotency key. The same event can be delivered more than once, so check whether you’ve already handled an id before acting on it.5
Read the current resource
Treat a webhook as a signal that something changed, not as the final state. Events can arrive out of order, after a newer state already exists. When ordering matters, fetch the resource by ID and apply its current state.
Manage your configuration
To stop events temporarily, for example during maintenance, pause delivery with
PATCH /webhooks. Use DELETE /webhooks only when you intend to remove the configuration.Next steps
Webhook events
See every event type and its payload
Onboard a user
Create a KYC profile and start onboarding.