Webhooks

Receive real-time HTTP notifications for events in The Wallet Crew.

Webhooks allow systems to receive real-time HTTP notifications whenever an event occurs in The Wallet Crew. Webhook registration is self-serve through Settings → General → Webhooks in the admin console. No API call is required to create or manage webhooks.

Manage webhooks from the console

Open Settings → General → Webhooks. The list shows all registered webhooks, including Description, Endpoint, Events, and Enabled status.

To create or edit a webhook, open its edit form. The form contains the following fields:

• ID — Auto-generated and read-only. Use this value to reference the webhook through the API.
• Secret — The HMAC signing key used to verify deliveries. A show/hide toggle controls visibility. Store this value server-side and never expose it in client code.
• Enabled — Pauses or resumes delivery without deleting the webhook.
• Description — A label used for reference.
• Endpoint — The HTTPS URL that receives POST requests.
• Events — One or more event subscriptions. Use Add event and Remove event to manage the list.

Event filter syntax

Each Events entry is a string. Three forms are supported:

Syntax	Meaning
*	Subscribe to all events.
Pass:*	Subscribe to all events in the Pass category.
Pass:Created	Subscribe to one specific event.

Wildcards and explicit events can be combined in the same webhook. For example:

• ["Customer:*", "Pass:Created"]
• ["Pass:*", "Redirect:Redirected"]

Signature validation

Every delivery includes the x-neostore-signature header. Validate it server-side with the webhook Secret. See the Webhooks developer guide for the full validation pattern and event payload reference.

Always validate x-neostore-signature on every incoming request. Do not rely solely on network IP allowlists.