Configuration
Configure your organization's destination and subscriptions through the Platform or API.
Each organization has one webhook destination and one active signing secret. Configure it in the Platform or from your server.
| Detail | Value |
|---|---|
| Base URL | https://api.sandbox.tapaya.com for sandbox, https://api.tapaya.com for production |
| Authentication | Server Secret Token in Authorization. See Authentication. |
| Scope | One destination per organization |
| Related guide | Verify and Test |
Configure in the Platform
Open API Keys for your organization and find Webhooks.
- Enter your public HTTPS URL.
- Choose the events you need, or turn on Subscribe to all webhook types.
- Turn on Enable and click Save.
- Copy the signing secret and store it on your server.
- Send a test webhook.
The signing secret is shown once
Copy it when you create or rotate the destination; it cannot be retrieved later. It only verifies incoming webhooks. Your Server Secret Token authorizes configuration requests.
All operations
| Operation | Use it to |
|---|---|
| Save a destination | Create or replace the current subscription, or rotate its signing secret. |
| Read a destination | Retrieve the current URL, subscription mode, and enabled state. |
| Delete a destination | Remove the subscription and its delivery queue and history. |
Manage the destination
Destination rules
Changing settings
| When you | What happens |
|---|---|
| Change the URL, events, or secret | New events use the new settings. Queued events keep the old URL and secret, so keep both working until the queue drains. |
| Disable webhooks | Queued deliveries pause and no new events are captured. Re-enabling resumes the queue, but missed changes are not backfilled. Tests still work. |
| Delete the destination | Queued events and delivery history are removed. A request already in flight can still arrive. Recreating it creates a new signing secret. |
URL requirements
- Public HTTPS on port 443. Localhost and private networks are rejected, and DNS is checked again on each connection.
- No embedded credentials, no fragment, and no redirects.
- No custom authorization headers. Verify the Tapaya signature instead, or put a server-side adapter in front of a URL that needs its own key.
Errors
Configuration requests fail with these responses. A receiver that rejects or misses a delivery is a different problem; see Handle errors.
| Response | Meaning |
|---|---|
400 on PUT | Invalid URL, unsupported event type, missing required field, or an empty explicit event selection. |
401 | The Server Secret Token is missing or invalid. |
404 on GET | No destination exists for the authenticated organization. |
Continue with signature verification and test delivery.
Missing something on this page?Request a feature. We attach this page so the team sees the context.