Configure Webhooks - Yuno API Documentation

A webhook is configured the same way regardless of how you set it up, with a destination url, at least one trigger, and optionally how Yuno authenticates to your endpoint. See Events and Triggers for the full catalog of events you can select.

Dashboard
API

Navigate to the Developers tab
Click Webhook endpoints
Click Add webhook

A panel will open where you’ll configure:

Name: Identify your webhook
Endpoint URL: Your server URL to receive notifications
x-api-key: Your API key, sent in notification headers (api_key via the API)
x-secret: Your secret, sent in notification headers (secret via the API)
Use OAuth 2.0 authentication: Optional checkbox for OAuth2
Use HMAC signing: Optional checkbox for HMAC signature verification
Trigger on: Select which events will trigger this webhook, grouped by category (Enrollment, Payment, Report, Subscription, Onboarding), each with its own Select all link
Apply to accounts: For organizations with more than one account, choose which accounts this webhook applies to. Defaults to the current account.

Once configured, the webhook will send notifications whenever the selected events occur. The image below shows the panel to add a webhook.

In the Yuno dashboard Developers tab, you can activate and deactivate webhooks using the Status toggle button.

Send the destination url, a unique name, and at least one trigger to Create a Webhook:

cURL

curl -X POST 'https://api-sandbox.y.uno/v1/webhooks' \
  -H 'public-api-key: <YOUR_PUBLIC_API_KEY>' \
  -H 'private-secret-key: <YOUR_PRIVATE_SECRET_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
    "account_id": "<ACCOUNT_ID>",
    "name": "Order updates",
    "url": "https://your-endpoint.example.com/yuno-webhooks",
    "payment_triggers": ["AUTHORIZE", "PURCHASE"]
  }'

The response includes the id you use to retrieve, update, or delete it. See the full Webhooks API reference for every field, including delivery authentication and error responses.

Access the Payloads and Examples page to check examples for payment, enrollment, and many other notification events.

HMAC authentication

Check Use HMAC signing in the dashboard and fill in the Client Secret Key field, or set hmac_client_secret via the API. Either way, Yuno uses that key to generate an HMAC-SHA256 signature and sends it in the x-hmac-signature header with each delivery, so you can verify a webhook genuinely came from Yuno and wasn’t tampered with. See the Verify Webhook Signatures (HMAC) guide for implementation details.

OAuth2

Check Use OAuth 2.0 authentication in the dashboard, or set the matching fields via the API, so Yuno can obtain the token it sends with each delivery:

Dashboard field	API field	Description
Authentication URL	`oauth2_authentication_url`	Your token endpoint, over HTTPS.
Client ID	`oauth2_client_id`	The client identifier Yuno authenticates with.
Client Secret Key	`oauth2_client_secret`	The client secret Yuno authenticates with.
Grant Type	`oauth2_grant_type`	The grant type Yuno requests the token with, typically `client_credentials`.
Scope (optional)	`oauth2_scope`	The OAuth2 scope to request, if your authentication service requires one.

The API also exposes oauth2_authorization_name (the header Yuno sends the token in, defaults to Authorization) and oauth2_include_client_id. These don’t have a dashboard equivalent yet. See OAuth2 for the full field reference.

​HMAC authentication

​OAuth2

HMAC authentication

OAuth2