> For the complete documentation index, see [llms.txt](https://docs.omni.integratedcommerce.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.omni.integratedcommerce.io/webhooks/svix/configuration.md).

# Configuring endpoints

Self-service endpoint management in the webhook portal: endpoints, subscriptions, signing secrets, rotation, retries, and replays.

{% hint style="warning" %}
Svix webhooks are invite only. This page applies once Fiska has enabled Svix for your account - see [Requesting access](/webhooks/svix.md#requesting-access). Legacy endpoints are configured through support instead; see [Configuring endpoints](/webhooks/legacy/configuration.md) for legacy webhooks.
{% endhint %}

Endpoints are managed from the webhook portal, reached from the partner portal (see [Where the portal is](/webhooks/svix.md#where-the-portal-is)). From there you can:

* Add one or more endpoint URLs
* Choose the event types each endpoint subscribes to
* Inspect delivery attempts
* Replay failed messages

Each endpoint has its own signing secret (prefixed `whsec_`), shown in the portal.

## Signing secrets

The signing secret is what makes signature verification possible, and it is the only thing standing between your handler and a forged event.

{% hint style="danger" %}
Treat the signing secret exactly as you treat your API key: store it in a secrets manager, never in source control, never in client-side code, and never in a log line. Each endpoint has its own secret, so a compromised secret can be rotated for that endpoint alone.
{% endhint %}

Secret rotation is supported without downtime. While a rotation is in progress, deliveries may carry multiple signatures in the `svix-signature` header, and a payload is valid if *any* of them matches. Verifying with an official Svix library handles this for you.

## Choosing subscriptions per endpoint

Each event type is separate, and each endpoint independently chooses which types it subscribes to. Subscribe only to what you handle - an endpoint signed up for events it ignores still counts as a delivery, and failures against it can contribute to the endpoint being disabled automatically.

A common pattern is one endpoint per concern: one for transaction events feeding your order system, another for merchant lifecycle events feeding your onboarding workflow.

<figure><img src="https://2831455276-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZEhfhCESvZbNNPd1VI61%2Fuploads%2Fgit-blob-8d1d1a16ce4ee9e308a863a77d65022d48d0cbe0%2Fsvix-add-endpoint.png?alt=media" alt="New webhook endpoint form with URL, description, and event subscription choices"><figcaption><p>Enter the endpoint URL and select the event types it should receive.</p></figcaption></figure>

## Retries and replays

When a delivery fails, Svix retries it automatically on an exponential backoff schedule over roughly the following day. Endpoints that keep failing may be disabled automatically.

Failed deliveries can be inspected and replayed manually from the portal, which is the recommended recovery path after an outage on your side - you do not need to ask Fiska to resend.

<figure><img src="https://2831455276-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZEhfhCESvZbNNPd1VI61%2Fuploads%2Fgit-blob-02da87d78bf9c4ee829e33b1c77f1d4ad0f74e9d%2Fsvix-log.png?alt=media" alt="Svix message log listing event types, message IDs, and timestamps"><figcaption><p>Use the message log to find a webhook event.</p></figcaption></figure>

<figure><img src="https://2831455276-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZEhfhCESvZbNNPd1VI61%2Fuploads%2Fgit-blob-7259ee21958cbab7d8fd4642f10bd4fed9336fef%2Fsvix-log-detail.png?alt=media" alt="Svix message details showing a token.created event and its JSON payload"><figcaption><p>Open a message to inspect its event data.</p></figcaption></figure>

## Requirements for your endpoint

* Reachable over HTTPS from the public internet
* Returns a `2xx` promptly - do slow work asynchronously
* Idempotent, because retries, replays, and dual delivery while you move from legacy mean an event can arrive more than once; [deduplicate on `event.id`](/webhooks/webhooks.md#deduplicate-on-event-id)
* Verifies the signature before doing anything else

{% hint style="info" %}
If you need to reconcile without waiting for a replay, [`GET /transactions`](/payments/transaction-retrieval.md) gives you the current state of any transaction directly.
{% endhint %}

## Next steps

* [Verifying signatures](/webhooks/svix/verifying-signatures.md)
* [Event catalog](/webhooks/events.md)