Webhooks
Receive signed notifications for asynchronous money movement and review events.
Webhooks are the source of truth for final state transitions.
Event delivery
M2Square sends events to configured HTTPS endpoints. Return 2xx only after durable storage.
Signature verification
import crypto from 'node:crypto';
export function verifyWebhook(rawBody: string, signature: string, secret: string) {
const expected = crypto
.createHmac('sha256', secret)
.update(rawBody)
.digest('hex');
return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}Common event types
| Event | When it fires |
|---|---|
payin.completed | A pay-in is available in your balance. |
payout.failed | A payout could not be delivered. |
settlement.completed | A settlement reached the destination rail. |
compliance.review_required | Sentra review is required before the transaction can proceed. |
liquidity.quote_expired | A reserved quote can no longer be used. |
Retry handling
Webhook processing must be idempotent. Store event.id, ignore duplicates, and replay internal jobs from your own durable queue.