Plan: Webhooks available on every plan.
Open Settings → API & Webhooks → Manage endpoints (or Webhooks directly).
Register Endpoint
- Enter a public https URL. PayBlah does not follow redirects.
- Optional description so your team knows what owns the URL.
- Tick the events you want:
- Payment recorded
- Invoice paid in full
- Debtor replied
- Dispute raised
- Promise to pay recorded
- Promise broken
- Chase completed
- Accounting sync failed
- Press Register Endpoint.
Until an endpoint exists, nothing is delivered. Delivery is queued so a slow receiver never blocks PayBlah.
Verify every request
Headers include event name, event id (stable across retries), delivery id, attempt, version, and PayBlah-Signature. Verify HMAC-SHA256 over t + "." + rawBody with your endpoint secret, compare in constant time, and reject timestamps older than 300 seconds. Read raw body bytes — do not re-serialize JSON before verifying.
Payload shape
Ids, amounts in minor units with currency, dates, and states. No debtor name, email, phone, address, free-text reply body, dispute reason, or payment link. Fetch more with your API key if you need it.