How to enable webhook in production?

This page gives the short answer first, then every step.

Short answer: Go to SETTINGS, More, Developer Panel, and open the Webhooks tab. Type your Webhook URL, pick your events, and click Update. The steps are below.

Step 1

Open the More page

Left menu with SETTINGS open and the More item at the bottom

Step 2

Click Developer Panel

The More page shows many small boxes. Find the box named Developer Panel. It says Access API keys, webhooks, and developer tools. Click it.

Step 3

See the three tabs

The Developer Panel page has three tabs at the top: API Settings, Webhooks, and Bank Accounts. Your API key is on the first tab.

Step 4

Open the Webhooks tab

Click the Webhooks tab in the middle at the top.

Webhooks tab with Webhook URL, Secret Key, Send test event, Status, and Events Subscription

Step 5

Type your Webhook URL

In Webhook URL, type the web address that will receive the messages. It is marked with a star (*), so you must fill it in.

Step 6

Add a Secret Key (optional)

In Secret Key, type a key of your choice. We use it to sign every message we send you. You can use it to check that a message really came from us. You do not have to add one unless you want to check the signature.

Step 7

Test your connection

Click Send test event. We send a sample message to your web address. Use this to make sure your page can receive webhooks. We suggest you test before you save.

Step 8

Choose the status

Under Status, pick Enabled to turn webhooks on. Pick Disabled to turn them off.

Step 9

Pick your events

Under Events Subscription, tick the boxes for the events you want. For example, tick check.mailing.tracking to hear about the mail status of a check, or check.updated to hear when a check changes. The page shows how many events you picked, for example 0 events selected.

Step 10

Save

Scroll down and click Update. Your webhook is saved.

How to check that a message is real

When you add a Secret Key, we sign the body of every message with it. We use an HMAC with SHA-256. Every message has a signature in its header. Work out the HMAC of the message body with your secret. If it matches the signature, the message is real. If it does not match, throw the message away.

See what was sent

On the right side of the page, the Support & Resources box has a link named See Webhook History. Click it to see the webhook logs. The box also has a link to the Webhook Documentation.

Production and sandbox

Do these steps on the Developer Panel of the site where you work. Real payments use your normal account. Tests use the sandbox site, which has its own Developer Panel.

Common questions

Do I need a Secret Key?

No. It is only needed if you want to check the signature of each message.

I need more help.

Call (408) 775-7720, use the chat box in the lower right corner of the app, or email support@onlinecheckwriter.com.

Pay your vendors with Online Check Writer

Want help? Book a demo. Our team will answer your questions.

Get Started Book a Demo Log In

This page gives general information. It is not legal advice.