Skip to main content
This page covers practices that keep your webhook endpoint secure and your Fintoc integration reliable. You learn how to filter events, handle duplicate deliveries, and verify that events come from Fintoc.

​
Choose event types

Configure your endpoint to listen only to the events your application needs. Ignoring the rest avoids extra load on your server.

​
Handle duplicate events

Fintoc can send the same event more than once, such as after a delivery retry. Make your endpoint idempotent so repeated events cause no duplicate work. Store each event’s id after processing the event. Discard events with an id you have already stored.

​
Security

Securing your endpoints protects your customers’ information. Use HTTPS to protect your endpoint and verify each event’s origin.

​
Receive events with an HTTPS server

Your webhook endpoint must serve HTTPS with a valid TLS certificate. Fintoc does not send events to endpoints without a valid certificate.

​
Verify that events come from Fintoc

Verify webhook signatures to confirm events come from Fintoc. Also verify that events originate from one of these IP addresses: