Webhooks

Set Up a Webhook Endpoint

Register an HTTPS endpoint to receive Cresora webhook events.

Requirements

A publicly reachable HTTPS endpoint
Valid TLS certificate (self-signed not accepted)
Responds with 2xx within 30 seconds

Register in the Partner Portal

Go to API Settings → Webhooks → Add Endpoint
Enter your endpoint URL (e.g. https://yourapp.com/webhooks/cresora)
Select the events you want to receive (or choose "all events")
Copy the signing secret — displayed once

Your endpoint is immediately active. Cresora sends a test delivery webhook.test to verify reachability.

Local development

For local testing during development, use a tunnel service to expose your local server:

# ngrok (example — any tunnel service works)
ngrok http 3000
# Copy the https://xxxx.ngrok.io URL → use as your webhook endpoint in the Portal

💡Tip

See Testing webhooks locally for a full local development workflow including Cresora's replay tools.

Next: verify the signature

Every delivery includes an X-Cresora-Signature header. Always verify it before processing the event body.

Signature verification →

Webhooks

Receive real-time event notifications for payment lifecycle changes.

Signature Verification

Verify HMAC-SHA256 webhook signatures to authenticate Cresora deliveries.

On this page

Requirements Register in the Partner Portal Local development Next: verify the signature