Configure a receiver on your backend
Set callback_url during creation to choose the destination for that transaction. If omitted, the Tenant webhook configuration applies. Your receiver must accept the documented format and preserve incoming bytes before parsing JSON.
The payload includes api_version, event_id, event_type, created_at and transaction. Headers X-Face-Auth-Event-Id, X-Face-Auth-Event-Type, X-Face-Auth-Timestamp and X-Face-Auth-Signature identify and authenticate delivery. See the complete reference for event enums.
A delivery may repeat
Deduplicating by transaction_id would discard different events from the same journey. Use event_id with durable, concurrency-safe storage. Verify the signature before trusting an event and check consistency between the envelope and header event identifiers.
The receiver can persist a verified event in a durable queue and process it separately. Return success only after durably accepting the work; an acknowledgment must not conceal data loss.
Do not depend on arrival order
A retry or delay can deliver an older event after a newer one. Read the transaction with GET to reconcile its state before releasing business side effects. Make those effects idempotent so a repeated attempt cannot release something twice.
Continue with HMAC verification and redelivery and reconciliation. A production integration also handles invalid signatures, temporary unavailability and out-of-order events.