Skip to main content
Webhooks notify your system about payments, links, refunds, payouts, and capabilities. Verify each delivery before applying effects.

​
Register an endpoint

POST /v1/webhook_endpoints requires an HTTPS URL and a closed event list. Creation also requires idempotency and step-up where applicable.

​
Process each delivery

1

Read the unmodified body

Preserve the exact bytes received from SimplePay.
2

Verify signature and timestamp

Reject invalid signatures and timestamps outside the tolerance.
3

Deduplicate the event

Insert the event ID under a unique constraint before applying effects.
4

Respond promptly

Persist the event and return 2xx. Queue expensive work durably.
You can list, retrieve, update, and delete endpoints. Secret rotation returns the new secret once.
Verifying reserialized JSON breaks the signature contract. Always use the original body.
Last modified on August 22, 2026