Configure Webhooks

A webhook is configured the same way regardless of how you set it up, with a destination url, at least one trigger, and optionally how Yuno authenticates to your endpoint. See Events and Triggers for the full catalog of events you can select.

Dashboard
API

Navigate to the Developers tab
Click Webhooks
Click Add webhook

A sidebar will open where you’ll configure:

Name: Identify your webhook
Endpoint URL: Your server URL to receive notifications
x-api-key: Your API key, sent in notification headers (api_key via the API)
x-secret: Your secret, sent in notification headers (secret via the API)
Use OAuth2 Authentication: Optional checkbox for OAuth2
Use HMAC Authentication: Optional checkbox for HMAC signature verification
Trigger on: Select which events will trigger this webhook (enrollment, payment, subscription, etc.)

Once configured, the webhook will send notifications whenever the selected events occur. The image below shows the side panel to add a webhook.

In the Yuno dashboard Developers tab, you can activate and deactivate webhooks using the Status toggle button.

Send the destination url, a unique name, and at least one trigger to Create a Webhook:

cURL

curl -X POST 'https://api-sandbox.y.uno/v1/webhooks' \
  -H 'public-api-key: <YOUR_PUBLIC_API_KEY>' \
  -H 'private-secret-key: <YOUR_PRIVATE_SECRET_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
    "account_id": "<ACCOUNT_ID>",
    "name": "Order updates",
    "url": "https://your-endpoint.example.com/yuno-webhooks",
    "payment_triggers": ["AUTHORIZE", "PURCHASE"]
  }'

The response includes the id you use to retrieve, update, or delete it. See the full Webhooks API reference for every field, including delivery authentication and error responses.

Access the Payloads and Examples page to check examples for payment, enrollment, and many other notification events.

HMAC authentication

Check Use HMAC Authentication in the dashboard, or set hmac_client_secret via the API. Either way, Yuno uses that key to generate an HMAC-SHA256 signature and sends it in the x-hmac-signature header with each delivery, so you can verify a webhook genuinely came from Yuno and wasn’t tampered with. See the Verify Webhook Signatures (HMAC) guide for implementation details.

OAuth2

Check Use OAuth2 Authentication in the dashboard, or set the matching fields via the API, so Yuno can obtain the token it sends with each delivery:

Dashboard field	API field	Description
Authentication URL	`oauth2_authentication_url`	Your token endpoint, over HTTPS.
Client ID	`oauth2_client_id`	The client identifier Yuno authenticates with.
Client Secret	`oauth2_client_secret`	The client secret Yuno authenticates with.
Grant Type	`oauth2_grant_type`	The grant type Yuno requests the token with, typically `client_credentials`.

The API also exposes oauth2_scope, oauth2_authorization_name (the header Yuno sends the token in, defaults to Authorization), and oauth2_include_client_id. These don’t have a dashboard equivalent yet. See OAuth2 for the full field reference.

Getting Started

Core Concepts

Using Yuno

Direct Integration Use Cases

Payment Features

Payouts and Disputes

Webhooks

Wallets

AI Capabilities

Security and Compliance

Plugins

Additional Services

HMAC authentication

OAuth2

​HMAC authentication

​OAuth2

HMAC authentication

OAuth2