Webhooks
Webhooks
Receive real-time event notifications for payment lifecycle changes.
Webhooks are the authoritative source for payment lifecycle state on the Cresora platform. Build your integration around webhook events rather than polling the API.
How Cresora delivers webhooks
- You register an HTTPS endpoint URL in the Partner Portal
- Cresora delivers a signed POST request for each event
- Your server verifies the HMAC-SHA256 signature
- Your server returns
2xxwithin 30 seconds - Cresora retries on non-
2xxresponses with exponential backoff
Retry schedule
| Attempt | Delay |
|---|---|
| 1st retry | 30 seconds |
| 2nd retry | 5 minutes |
| 3rd retry | 30 minutes |
| 4th+ | Exponential backoff, max 12 hours |
| Window | 72 hours total |
After 72 hours of failed delivery, the event is marked failed and a webhook.delivery_failed meta-event is sent to your notification email.
⚠Warning
Reject deliveries with a timestamp older than 5 minutes — this protects against replay attacks. Check the X-Cresora-Timestamp header.
Webhook delivery stats
Cresora tracks delivery success rate per endpoint. If your endpoint's success rate drops below 80%, you'll receive a webhook.endpoint_degraded alert.