Legacy webhooks
The delivery method every merchant has today. Support configures your endpoints, and every delivery is signed with the x-fsk-wh-chksm checksum.
Legacy webhooks are the delivery method every merchant has today. You do not opt in: when your account is set up, support registers the endpoint URLs you give them, subscribes each one to the event types you want, and gives you the shared secret that signs every delivery.
Legacy webhooks remain supported, with no announced retirement date. Svix webhooks are available by invitation. If Svix is enabled for your account, follow Moving from legacy to Svix to configure and verify the new deliveries.
What you get
| Set-up | Through support: endpoint URLs, event types, and the shared secret. See Configuring endpoints. |
| Events | Transaction events and token events. Merchant lifecycle events are delivered on Svix webhooks only. |
| Signature | One header, x-fsk-wh-chksm: an HMAC-SHA256 of the raw request body, keyed with the shared secret, encoded as lowercase hex. See Verifying the checksum. |
| Retries | Failed deliveries are retried, but not on a published schedule. |
| Inspecting deliveries | No portal. Ask support to investigate a delivery, or reconcile against GET /transactions. |
What a delivery looks like
POST /webhooks HTTP/1.1
Content-Type: application/json
x-fsk-wh-chksm: 862c6f2473c97472be4262b04670e777b2ed145d12d8a1c79ffc52ea9cfe7f0f
The body is the JSON event payload described in the event catalog. The checksum above is the one from the worked example.
Know the limits
The legacy checksum covers only the body and carries no timestamp, so a captured delivery stays valid indefinitely and can be replayed. Deduplicating on event.id - which you need anyway, because deliveries are retried - is what closes this gap: a replayed event carries an event.id you have already processed.
There is no self-service way to add an endpoint, rotate the secret, or replay a failed delivery. Each of those is a request to support. If you need any of them regularly, ask support whether your account can be invited to Svix webhooks.
Next steps
- Configuring endpoints
- Verifying the checksum
- Event catalog
- Moving from legacy to Svix, once Svix is enabled for your account