subscription_started when a subscription starts: at free-trial activation (purchase.status: "trialing") and at the first successful positive payment (purchase.status: "succeeded"). A subscription that starts with a trial produces both, as two events with different event_id values. A renewal, checkout completion page, or browser callback does not create this event.
GamiFest’s Plan and sign-up ending sends signup_requested after the visitor submits an email with the completed quiz. This separate event contains no payment fields. The receiver returns a validated onboarding magic link for the Install button. Use the sign-up guide for dashboard configuration, both JSON examples, response limits, and Meta StartTrial behavior.
The payload includes FloKit and provider payment references, the purchased Package, customer identity, and answered questionnaire information when applicable. Optional values are omitted when unavailable. Treat the payload as sensitive customer data and apply appropriate access and retention controls.
Delivery is at least once. Verify the signature over the raw request bytes, store or queue the event durably under a unique event_id, and return 200 or 204 only after acceptance commits. A timeout can cause another request even if the first request was accepted.
For signup_requested, return HTTP 200 with the JSON handoff described in the sign-up response contract. A plain acknowledgment or HTTP 204 cannot enable Install.
Each endpoint is configured for one Company, App, and environment. New endpoints receive future events; provisioning does not backfill previous purchases. All receivers belonging to a Company use that Company’s signing secret, so coordinate secret rotation across those receivers.
Start with receiver setup, then signature verification, the payload reference, and delivery troubleshooting.
These notifications travel from FloKit to your server. For payment-provider notifications into FloKit, use Stripe setup or Paddle notifications.