Skip to main content
Follow these practices to secure your webhooks and keep your Fintoc integration working as expected.

​
Types of events

Configure your webhook to listen only for the events your application needs. Ignore other events to avoid unnecessary load on your server.

​
Handle duplicate events

Fintoc might send the same event more than once. Make your webhook endpoint idempotent so repeated events do not trigger duplicate processing. Use the event id as an idempotency key. Atomically apply the event’s effects and record the event id, then discard any event with an id you have already recorded.

​
Security

Use the following measures to protect customer information and verify that events come from Fintoc.

​
Receive events with an HTTPS server

Your webhook endpoint must use HTTPS with a valid certificate. Fintoc does not send events to unsecured endpoints.

​
Verify events are sent from Fintoc

Verify webhook signatures to confirm that Fintoc sent each event. Also verify that requests originate from one of these IP addresses: