1
Expose a public endpoint
Your webhook URL must be publicly reachable over HTTPS and return a
200 OK with no response body.2
Register the URL
In the Business Dashboard, go to
Developer — the same page where you manage API keys, see
Getting API Credentials — and save
your endpoint URL. A webhook secret is generated for you at the same time.
3
Verify incoming events
Every delivery is signed with
x-signature and x-timestamp headers
generated from your webhook secret. See
Webhook Verification for the exact
algorithm and a code sample.4
Handle retries idempotently
Deliveries are retried with exponential backoff until your endpoint
returns
200 OK. Deduplicate on the payload’s activity/event id, since a
retried delivery is not distinguished from a first attempt at the
application level.