> ## Documentation Index
> Fetch the complete documentation index at: https://docs.momentco.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks

> Add and manage webhook endpoints for a business unit in the Client Portal

Webhooks send an event notification to a URL on your server whenever something changes on your account, for example when a payment session is completed. The **Webhooks** section in Client Portal Settings is where you add an endpoint, copy its signing secret, and later disable it or rotate the secret. For how events are delivered and what they contain, see the [webhooks overview](https://docs.momentco.io/api-reference/webhooks/overview.md).

* Endpoints belong to the business unit selected in the header. Switch business unit to manage another business unit's endpoints.
* Each endpoint receives events from both test and live mode.
* Endpoints receive payment session and payment events. Choosing individual event types isn't available yet.
* Anyone with access to webhooks can view endpoints and copy their URL and signing secret. Adding, disabling, re-enabling, and rotating need permission to manage webhooks. If the section or its buttons are missing, ask an admin on your account to check your role.

The steps below follow a user with permission to manage webhooks adding their first endpoint.

## Step 1: Open the Webhooks section

Select **Settings** in the sidebar and scroll to **Webhooks**. Until the business unit has an endpoint, the section shows **No webhook configured**.

![Webhooks section with no endpoint configured](https://mintcdn.com/momentholdingslimited/Phg0ewOS3k_67K4f/guides/resources/webhooks-empty-state.png?fit=max\&auto=format\&n=Phg0ewOS3k_67K4f\&q=85\&s=eedb067fa337a6dc13ab582066e8a3a2)

## Step 2: Add an endpoint

Select **Configure** to open the **Configure webhook** panel. Once the business unit has an endpoint, add more with **Create** in the section header.

* **Endpoint URL** (required): The URL Moment sends a `POST` request to for each event. It must use `https` and a public domain name, for example `https://api.example.com/webhooks/moment`. IP addresses and `localhost` aren't accepted. Ports, paths, and query strings are.
* **Secret** (optional): Leave it blank and Moment generates a signing secret for the endpoint. To use your own, enter `whsec_` followed by 24 to 64 random bytes, base64 encoded.

Select **Save configuration**. The endpoint is created and the panel switches to its details.

![Configure webhook panel](https://mintcdn.com/momentholdingslimited/Phg0ewOS3k_67K4f/guides/resources/webhooks-configure.png?fit=max\&auto=format\&n=Phg0ewOS3k_67K4f\&q=85\&s=8b30d5067f5bc4faa546c9ae80d7bca6)

## Step 3: Copy the signing secret

The endpoint's details show its **Endpoint URL** and **Secret**. The secret is masked on screen, showing only its last four characters. Select the copy icon next to it to copy the full value.

Store the secret on your server and use it to check that each event came from Moment. See [Verification](https://docs.momentco.io/api-reference/webhooks/verification.md).

![Webhook endpoint details](https://mintcdn.com/momentholdingslimited/Phg0ewOS3k_67K4f/guides/resources/webhooks-endpoint-details.png?fit=max\&auto=format\&n=Phg0ewOS3k_67K4f\&q=85\&s=fbed56848772c2f27c3dd3f25a415005)

***

## Manage an endpoint

The **Webhooks** section lists each endpoint's **Endpoint URL** and **Status**, which is either **Active** or **Disabled**. Select an endpoint to open its details. The actions to disable an endpoint and rotate its secret are under **Danger zone** in the details panel.

![Webhooks section listing an active and a disabled endpoint](https://mintcdn.com/momentholdingslimited/Phg0ewOS3k_67K4f/guides/resources/webhooks-list.png?fit=max\&auto=format\&n=Phg0ewOS3k_67K4f\&q=85\&s=df520f079c0ed7382c5deaae768758d9)

### Disable an endpoint

Select **Disable**, then confirm with **Disable endpoint**. Moment stops sending events to the URL straight away. Events that occur while the endpoint is disabled aren't delivered later, including after it's re-enabled.

### Re-enable an endpoint

Open a disabled endpoint and select **Re-enable endpoint**. Moment resumes sending new events to the URL.

### Rotate the signing secret

Select **Rotate**, then confirm with **Rotate secret**. Moment generates a new signing secret and the old one stops working immediately. Events fail verification on your server until it uses the new secret, so have that change ready to deploy before you rotate.

![Rotate secret confirmation dialog](https://mintcdn.com/momentholdingslimited/Phg0ewOS3k_67K4f/guides/resources/webhooks-rotate-confirm.png?fit=max\&auto=format\&n=Phg0ewOS3k_67K4f\&q=85\&s=6f0831f441969a05ace1b7c2e48b0bf7)

## Good to know

* An endpoint's URL can't be edited. To change it, add an endpoint with the new URL, update your server, then disable the old endpoint.
* Endpoints can't be deleted from the Client Portal. Disable any endpoint you no longer use.
* For delivery timing and retries, see [Processing events](https://docs.momentco.io/api-reference/webhooks/setup.md#processing-events).
* If your endpoint sits behind a firewall, allow Moment's source IP addresses. See [Additional security precautions](https://docs.momentco.io/api-reference/webhooks/verification.md#additional-security-precautions).

## Next steps

👉 [Setup](https://docs.momentco.io/api-reference/webhooks/setup.md)

👉 [Verification](https://docs.momentco.io/api-reference/webhooks/verification.md)

👉 [Integration testing](https://docs.momentco.io/api-reference/getting-started/testing.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.