Configure Webhooks
Overview
Webhook URLs are registered only in the dashboard (https://banking.fypay.me), under Settings → Webhooks. There is no API endpoint to register, list or remove webhooks, nor to generate the signing key.
Webhook configuration changes are applied immediately. Subsequent events will use the configured URLs.
Register a webhook
Sign in to https://banking.fypay.me and open Settings → Webhooks.
Select the event type the URL will receive:
cash_in- PIX receivedcash_out- PIX sentrefund_in- Cash-in refundrefund_out- Refund receivedmed_created- MED (Special Refund Mechanism) opened against a received transactionmed_accepted- MED refund request approvedmed_rejected- MED refund request rejected
Enter your endpoint URL. It must use HTTPS (HTTP is not accepted) and be a valid public URL (private or internal addresses are rejected).
Example: https://api.example.com/webhooks/pix
Register up to 5 headers that will be sent with every webhook to this URL. Useful to authenticate the call on your endpoint (for example, Authorization or X-Webhook-Secret).
- Header name: only letters, numbers,
-and_ - Header value: cannot be empty
- Blocked headers:
host,content-length,connection,transfer-encoding,content-type,user-agent
Define the payload format sent to this URL for transaction events:
- Standard (default): format described in this Webhooks section
- PIX BACEN: format from the PIX BACEN tab
MED events always use the same payload, regardless of the version.
In the same menu, generate the HMAC signing key. From then on, every webhook carries the X-Avista-Signature header, which you should validate on your endpoint. See Implementation for the step-by-step on generating, rotating and validating it.
Multiple URLs per Event
You can register up to 3 active HTTPS URLs for the same event. Registering a new URL adds it to the event; URLs already registered remain active and are not replaced.
When the event occurs, the notification is sent in fan-out to all active URLs registered for that event. Each URL has its own delivery and retries: a failure in one URL does not affect the others.
To edit the headers or version of a URL, or to remove it and free up space within the limit of 3, use the same Settings → Webhooks menu.
Configuring Multiple Events
To receive notifications for several event types, register the URL on each desired event in the dashboard.
You can use the same URL for all event types and tell them apart by the event field in the webhook payload.
Next Steps
Overview
Events, authentication, IP allowlist and payload structure
Implementation
Code examples to process webhooks and validate the signature
Resend Webhook
Resend lost webhooks or for testing
Cash-In Webhook
Details of the PIX received webhook
MED Webhooks
Receive notifications about MED (Special Refund Mechanism) events