TokeniWebhooks
Dashboard-managed endpoints. HMAC-SHA512 over a metadata-only JSON body.
Configure URLs in the dashboard. Tokeni POSTs when a token is created or a transaction finishes. The body never includes a PAN or CVV.
Payload
{
"type": "transaction.success",
"uuid": "the-transaction-or-token-id",
"transactionType": "DEBIT",
"transactionStatus": "SUCCESS"
}type | Meaning |
|---|---|
token.created | A tokenize completed |
transaction.success | Charge (or other txn) succeeded |
transaction.failed | Charge (or other txn) failed |
Signature
Header: X-Signature
Base64(HMAC-SHA512(endpoint_secret, raw_body))The secret is shown once when you create the endpoint. Verify with a constant-time compare against the exact bytes you received. Do not re-serialize the JSON before verifying.
Retry
Failed deliveries are visible in the dashboard. You can retry a delivery from there. Treat handlers as idempotent on uuid + type.