> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onboard.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring and Verifying Webhooks

Webhooks notify your systems in real time when account or transaction
activity happens — a deposit lands, a payout completes, a beneficiary is
added.

<Steps>
  <Step title="Expose a public endpoint">
    Your webhook URL must be publicly reachable over HTTPS and return a
    `200 OK` with no response body.
  </Step>

  <Step title="Register the URL">
    In the [Business Dashboard](https://business.onboard.xyz), go to
    **Developer** — the same page where you manage API keys, see
    [Getting API Credentials](/guides/api-concepts/api-credentials) — and save
    your endpoint URL. A webhook secret is generated for you at the same time.
  </Step>

  <Step title="Verify incoming events">
    Every delivery is signed with `x-signature` and `x-timestamp` headers
    generated from your webhook secret. See
    [Webhook Verification](/api-reference/webhook-verification) for the exact
    algorithm and a code sample.
  </Step>

  <Step title="Handle retries idempotently">
    Deliveries are retried with exponential backoff until your endpoint
    returns `200 OK`. Deduplicate on the payload's activity/event id, since a
    retried delivery is not distinguished from a first attempt at the
    application level.
  </Step>
</Steps>

For the full list of events you can receive, see [WebHook Events](/api-reference/webhook-events).