Skip to main content
Get a signed event on your server when a transaction changes. Use webhooks to confirm a payment that your server did not see complete, for example when settlement fails or a response is lost. Webhooks cover every transaction of your Seller account. This includes payments from InFlow buyers and from other buyers.

Add an endpoint

Add your webhook endpoint in the InFlow dashboard of your Seller account, on the Webhooks page. The sandbox and production accounts are separate. Add an endpoint in each account.

Events

InFlow records some payments only when they settle. For these payments, you get only TRANSACTION_UPDATED.

Read the status

data.status gives the status of the transaction.

Check the signature

  1. Read the x-signature header. It has the form t=<timestamp>,v1=<digest>.
  2. Calculate the HMAC-SHA256 of <timestamp>.<raw body> with your webhook secret.
  3. Compare your result with v1. Use a constant-time comparison.
  4. Reject the request if the timestamp is more than 5 minutes from your server time.
Use the raw request body. Do not parse the JSON before you check the signature.

Retries

If your endpoint does not return a 2xx status, InFlow sends the event again. InFlow also sends it again after a network failure. InFlow sends up to 11 retries. The first retry is after 1 minute. Each delay is two times the delay before it. InFlow does not follow redirects. Each retry has a new signature timestamp.

Duplicates and order

Each retry has the same eventId. Process each eventId only one time. Events can arrive in a different order from the order of the changes.

Next step

Fees and payouts

Read what InFlow charges, and how you get your funds.
Last modified on November 13, 2026