Webhooks

A webhook is how the platform tells your server that something happened -- a payment succeeded, a dispute opened, a subscription renewed -- without you polling for it. Each event type has a page here: when it fires, when it does not, the payload, and the verification recipe.

Two rules hold for every event:

• Verify the signature against the raw request body, before you parse it. The scheme is the same for every event: the blackjack-signature header, HMAC-SHA256 over the timestamp and the raw body. The full recipe, with the five rules a verifier has to follow, is on Verifying signatures.
• Events can arrive out of order and more than once. Order on occurred_at and dedupe on the event id, never on arrival order. Building on arrival order is the second most common integration failure after treating a decline as an error.

The payload never carries card data, secrets, or a full CAVV. If you need the full resource, retrieve it by the id the event carries.