Set up a receiver

Configure the endpoint

For GamiFest Plan and sign-up, use the separate sign-up receiver guide. Your FloKit contact provisions that event; the generic endpoint form and Send test below are for subscription events. Open Webhooks in the FloKit dashboard. Owners and admins can make changes; viewers see the pages read-only.

On the Endpoints tab, select Add endpoint.
Choose the App and environment, enter a name and your public HTTPS receiver URL, confirm the Subscription started event, and save.
On the Signing secret tab, reveal and copy the Company’s secret into your server’s secret manager. Every reveal is audited and hides automatically.
Select Send test on the endpoint, then check the result on the Deliveries tab.

If you prefer, your FloKit contact can configure the endpoint and send you the secret through a secure channel. Your receiver never needs FloKit dashboard credentials. Use a public HTTPS URL with a valid certificate. Private or localhost addresses and redirects are not supported. Requests authenticate with the FloKit signature; custom authorization headers are not supported. Keep the signing secret in your server’s secret manager, never in browser code, URLs, logs, or chat. All endpoints for a Company share its signing secret. Coordinate installation and rotation across those receivers.

Accept durably

After signature verification, validate the payload and accept it durably before acknowledging. This optional PostgreSQL example belongs to your receiver; another datastore with equivalent atomic behavior is suitable.

CREATE TABLE flokit_webhook_events (
  event_id TEXT PRIMARY KEY,
  payload JSONB NOT NULL,
  received_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE flokit_webhook_jobs (
  event_id TEXT PRIMARY KEY REFERENCES flokit_webhook_events(event_id),
  status TEXT NOT NULL DEFAULT 'pending'
);

-- Bind event_id and payload as parameters. Run both statements in one transaction.
WITH accepted AS (
  INSERT INTO flokit_webhook_events (event_id, payload)
  VALUES ($1, $2::jsonb)
  ON CONFLICT (event_id) DO NOTHING
  RETURNING event_id
)
INSERT INTO flokit_webhook_jobs (event_id)
SELECT event_id FROM accepted;

Commit before returning 200 OK or 204 No Content. A duplicate is a successful acknowledgment with no new job. Return a retryable error if the transaction fails. Process accepted work independently of the HTTP request. Use event_id for deduplication, not email, a provider Event ID, delivery ID, or an in-memory cache. Protect stored payloads; customer identity and questionnaire answers may be sensitive.

Test events

Use Send test on the endpoint. Its signed synthetic event contains test_event: true. Accept and deduplicate it normally, but skip business side effects. The test uses the Company’s actual signing secret. The test_event flag does not identify a payment provider’s Test mode. A checkout in a provider test account is a normal payment event without this flag. Use an isolated App and receiver for provider test purchases and verify the actual provider mode before testing. The payload’s environment is not independent proof of provider Test or Live mode. Confirm successful signature verification, durable acceptance, and duplicate handling before enabling business side effects. For failures, use delivery and troubleshooting.

Start

Platform

Setup guides

Outbound webhooks

AI assistant

SDKs

Configure the endpoint

Accept durably

Test events

​Configure the endpoint

​Accept durably

​Test events

Configure the endpoint

Accept durably

Test events