Callbacks (Webhooks)
Last updated
Last updated
Our service can send callbacks (or webhooks; we will use the word callback further in this article) when some events happen: invoice or channel created, received a payment, processed a payment, etc.
You can configure callbacks in the "Callbacks (Webhooks)" section in the Dashboard.
When you receive a callback from our service you have to check that this is a valid request. We use signatures for these checks.
Every callback has a header X-Munzen-Signature:
This header contains a signature, which generates very similar to API Authentication Signature.
Here is an example of how to validate a callback signature:
We recommend you white-list our IPs for callbacks and ignore requests from all other IPs. This will be an additional option to secure your callback endpoint. Here are our IPs:
Sandbox
34.65.94.128/32
Production
34.65.94.128/32
As mentioned above, we use retries in the case when we don't receive a 200 HTTP-code from your server. To avoid DDoS on your server from our side, we have an increasing time period for callbacks. Here is how it works:
30 + num ^ 4 + num, where num is the number of retries from 0 to 19.
Full list of retries time periods:
Sometimes callback handlers can contain complex business logic and take time to execute. That's why we recommend you save callback data and respond with 200 HTTP code. And after that process callback data in an async way.
Sometimes the same callback can be handled by your endpoint a few times. So you need to check every callback and try to log them to avoid double crediting your customer's balances.
We have 10 seconds limit for every callback response. So if your server will not respond within 10 seconds we will terminate the connection and mark the callback as unsuccessful. We will retry to send this callback again according to our .