Skip to main content
This page covers practices that keep your webhook endpoint secure and your Fintoc integration reliable. You learn how to filter events, handle duplicate deliveries, recover the events your endpoint missed, and verify that events come from Fintoc.

​
Choose event types

Configure your endpoint to listen only to the events your application needs. Ignoring the rest avoids extra load on your server.

​
Handle duplicate events

Fintoc can send the same event more than once, such as after a delivery retry. Make your endpoint idempotent so repeated events cause no duplicate work. Store each event’s id after processing the event. Discard events with an id you have already stored.

​
Recover missed events

Your endpoint can miss an event, such as when your server is down or your handler fails after Fintoc records the delivery. List events returns the events Fintoc generated for your organization, so you can reprocess them without waiting for a redelivery. Filter by type, by resource_id, or by the since and until time range to find the events you missed. Each event carries in data the same payload Fintoc sent to your endpoint. To inspect a single event, get the event with the id you received.

​
Security

Securing your endpoints protects your customers’ information. Use HTTPS to protect your endpoint and verify each event’s origin.

​
Receive events with an HTTPS server

Your webhook endpoint must serve HTTPS with a valid TLS certificate. Fintoc does not send events to endpoints without a valid certificate.

​
Verify that events come from Fintoc

Verify webhook signatures to confirm events come from Fintoc. Also verify that events originate from one of these IP addresses: