> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fintoc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks best practices

> Best practices for consuming Fintoc webhooks on the legacy v2023-11-15 API, including retries, idempotent handlers, signature checks, and event ordering.

Follow these practices to secure your webhooks and keep your Fintoc integration working as expected.

# Types of events

Configure your webhook to listen only for the events your application needs. Ignore other events to avoid unnecessary load on your server.

# Handle duplicate events

Fintoc might send the same event more than once. Make your webhook endpoint idempotent so repeated events do not trigger duplicate processing. Use the event `id` as an idempotency key. Atomically apply the event's effects and record the event `id`, then discard any event with an `id` you have already recorded.

# Security

Use the following measures to protect customer information and verify that events come from Fintoc.

## Receive events with an HTTPS server

Your webhook endpoint must use HTTPS with a valid certificate. Fintoc does not send events to unsecured endpoints.

## Verify events are sent from Fintoc

[Verify webhook signatures](/v2023-11-15/guides/resources/webhooks-walkthrough/webhooks-validating) to confirm that Fintoc sent each event. Also verify that requests originate from one of these IP addresses:

```text theme={null}
35.231.182.34
34.148.94.188 
35.196.9.17
35.231.238.212  
34.23.179.164
35.185.35.95  
34.139.249.17  
34.138.111.166  
34.139.233.199  
34.73.98.92  
35.227.79.175
```