Skip to main content
Use webhooks to drive payment, subscription, and payout state. Use polling only for debugging, recovery, or reconciliation.

When to use webhooks

  • Payment state changes for Pix, voucher, and card flows
  • Subscription renewals, failures, updates, and cancellation
  • Pix Out transfer progression and settlement
  • Fast order and payout updates without frontend polling

Delivery patterns

Central subscriptions

Use one stable endpoint when you want a shared ingestion pipeline for all recurring events.

Per-request callbacks

Set notify_url on a specific transaction or transfer when only one workflow should receive that callback. A notify_url postback is unsigned.

Example request with notify_url

Minimal ACK response

Common ingestion error

Status 400
Fix: validate the top-level webhook id before enqueueing work. Deduplicate by that ID, then process asynchronously.

Signatures

When the webhook has a Security Token, verify X-Pagou-Timestamp and X-Pagou-Signature before you trust the body. The check is in Verifying signatures. A webhook with no Security Token, and every notify_url postback, is unsigned. Reconciling with GET remains recommended.
  1. Accept the HTTPS POST.
  2. When the webhook has a Security Token, verify the signature. See Verifying signatures.
  3. Validate the top-level event ID.
  4. Return 200 OK quickly.
  5. Persist or enqueue the payload.
  6. Reconcile with GET if your worker crashes or a downstream side effect is uncertain.

Next steps