> ## Documentation Index
> Fetch the complete documentation index at: https://doc2.payloco.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Overview

> An introduction to Payloco webhooks, covering subscriptions, delivery retries, signature verification, and event configuration management.

# Webhooks Overview

Learn how Payloco webhooks work, including subscriptions, delivery and retries, signature verification, and where to configure or manage events.

Webhooks enable Payloco to send instant, real-time push notifications to your application when events occur in your Payloco account. Understanding how webhooks work helps you design reliable integrations.

## How Webhooks Work

You create a webhook subscription by registering a notification URL and selecting the events you want to receive. When one of those events occurs in your account, Payloco sends an HTTP POST request with a JSON payload to your URL. Your endpoint must return a `200` status code and the following response body for Payloco to consider the delivery successful:

```json theme={null}
{
  "code": "00000000",
  "message": "Success"
}
```

Each event has a stable `id`, so you can safely handle retries and avoid processing the same event twice. For instructions on creating subscriptions and configuring your endpoint, see [Listen for Webhook Events](./webhooks-signature).

You can also [view and re-trigger webhook events](https://www.payloco.com/docs/developer-tools/webhooks/view-and-re-trigger-webhook-events.md) in the Payloco Web App to inspect delivery status (successful, queued, or failed) and redeliver events after downtime or during debugging.

## Delivery and Reliability

Payloco treats any response other than a `200` status code with a response body `code` of `00000000`, or a timeout, as a failed delivery and will retry. Retries use an exponential backoff strategy until your endpoint returns `200`.

* **Duplicate events.** Your endpoint may receive the same event more than once. Implement idempotent processing by tracking the event `id` in the payload — the `id` does not change across retries for the same event.
* **Event ordering.** Payloco does not guarantee events are delivered in the order they were generated. Do not rely on delivery order; use the `notifyTime` field in the payload if ordering is required.

## Security and Verification

Payloco signs every webhook request so you can verify that it came from Payloco and has not been tampered with. The signature is computed as an HMAC using the request timestamp and request body; you compare the computed value against the signature in the request header. Each subscription has its own secret key in the Payloco Web App. Verifying the signature before parsing or processing the payload is a critical security step. For step-by-step instructions and code examples, see [Verify Webhook Signatures](https://www.payloco.com/docs/developer-tools/webhooks/listen-for-webhook-events#check-webhook-signatures.md).

Your webhook endpoint should use HTTPS, and your server must allow traffic from Payloco's webhook IP addresses. For the list of IPs for production and sandbox environments, see [Listen for Webhook Events](https://www.payloco.com/docs/developer-tools/webhooks/listen-for-webhook-events#whitelist-ip-addresses.md).

## See Also

To set up or manage webhooks, you can:

* [Listen for Webhook Events](https://www.payloco.com/docs/developer-tools/webhooks/listen-for-webhook-events.md) — create subscriptions, respond correctly, and verify signatures.
* [View and Re-trigger Webhook Events](https://www.payloco.com/docs/developer-tools/webhooks/view-and-re-trigger-webhook-events.md) — inspect events and redeliver them in the Web App.