> ## Documentation Index
> Fetch the complete documentation index at: https://ifdocdemo.lumivescence.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Get a signed event when a transaction changes. Check the signature, and process each event only one time.

Get a signed event on your server when a transaction changes. Use webhooks to confirm a payment that your server did not see complete, for example when settlement fails or a response is lost.

Webhooks cover every transaction of your Seller account. This includes payments from InFlow buyers and from other buyers.

## Add an endpoint

Add your webhook endpoint in the InFlow dashboard of your Seller account, on the **Webhooks** page. The sandbox and production accounts are separate. Add an endpoint in each account.

## Events

| Event | When InFlow sends it |
| - | - |
| `TRANSACTION_CREATED` | InFlow records a new transaction. |
| `TRANSACTION_UPDATED` | A transaction changes. |

InFlow records some payments only when they settle. For these payments, you get only `TRANSACTION_UPDATED`.

## Read the status

`data.status` gives the status of the transaction.

| Status | Meaning |
| - | - |
| `SETTLED` | The MPP or x402 payment settled. This is the only confirmed result. |
| `INITIATED`, `PENDING`, `PROCESSING` | The payment is not complete. |
| Any other value | Treat the payment as not paid. |

## Check the signature

1. Read the `x-signature` header. It has the form `t=<timestamp>,v1=<digest>`.
2. Calculate the HMAC-SHA256 of `<timestamp>.<raw body>` with your webhook secret.
3. Compare your result with `v1`. Use a constant-time comparison.
4. Reject the request if the timestamp is more than 5 minutes from your server time.

Use the raw request body. Do not parse the JSON before you check the signature.

## Retries

If your endpoint does not return a `2xx` status, InFlow sends the event again. InFlow also sends it again after a network failure. InFlow sends up to 11 retries. The first retry is after 1 minute. Each delay is two times the delay before it.

InFlow does not follow redirects. Each retry has a new signature timestamp.

## Duplicates and order

Each retry has the same `eventId`. Process each `eventId` only one time. Events can arrive in a different order from the order of the changes.

## Next step

> [card] [Fees and payouts](https://ifdocdemo.lumivescence.com/sellers/fees-and-payouts.md)
>
> Read what InFlow charges, and how you get your funds.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.