> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fintoc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook best practices

> Implement these best practices when using webhooks.

This page covers practices that keep your webhook endpoint secure and your Fintoc integration reliable. You learn how to filter events, handle duplicate deliveries, and verify that events come from Fintoc.

## Choose event types

Configure your endpoint to listen only to the events your application needs. Ignoring the rest avoids extra load on your server.

## Handle duplicate events

Fintoc can send the same event more than once, such as after a delivery retry. Make your endpoint idempotent so repeated events cause no duplicate work. Store each event's `id` after processing the event. Discard events with an `id` you have already stored.

## Security

Securing your endpoints protects your customers' information. Use HTTPS to protect your endpoint and verify each event's origin.

### Receive events with an HTTPS server

Your webhook endpoint must serve HTTPS with a valid TLS certificate. Fintoc does not send events to endpoints without a valid certificate.

### Verify that events come from Fintoc

[Verify webhook signatures](/guides/resources/webhooks-walkthrough/webhooks-validating) to confirm events come from Fintoc. Also verify that events originate from one of these IP addresses:

```text theme={null}
35.231.182.34
136.109.248.140
```