Webhooks are how Sequence pushes events to your app the moment they happen, so you don't have to keep asking us whether anything changed. When a transaction lands or a transfer moves, we send a signed message to a URL you control, and your app reacts right away.
This is a developer feature. If you're building an integration or connecting an agent, webhooks are usually the piece that makes it feel live instead of delayed.
Push instead of poll
Before webhooks, the only way to know something changed was to poll: your app would call the Platform API on a timer and diff the results, over and over, most of the time getting nothing new. That's slow to react and wasteful, and for external-transaction data it's especially blunt, since we pull from the bank on our own schedule.
With webhooks, you flip that around. You register an endpoint once, tell us which events you care about, and we push you a small notification the instant one fires. No timer, no polling loop, no waiting. Your integration reacts to real activity in near real time, and agents can act the moment money lands.
What you can subscribe to
Today you can subscribe to transaction and transfer events, so you'll hear about it whenever a transaction is created or updated and whenever a transfer is created or updated. The exact event names and the shape of each payload live in the developer docs, which stay current with every release.
One thing worth knowing up front: a webhook payload carries an id, not the full record. When you get an event, your app calls the API with that id to fetch the current state. That keeps the message small and, more importantly, means you always read the latest truth from the API rather than trusting a snapshot that may already be stale by the time it reaches you.
Is it safe?
Yes, and safety is built into how deliveries work.
Every delivery is signed. We sign each message with HMAC-SHA256 using a secret only you and Sequence know, and we send the signature along in the request headers. Your app verifies that signature before trusting the event, which proves the message really came from us and wasn't tampered with in transit. The developer docs walk through verification step by step.
You control the signing secret. When you create an endpoint, we generate a signing secret and show it to you once. Keep it somewhere safe, since we don't show it again. If it's ever exposed, you can rotate it from the settings, which issues a new secret so the old one stops being trusted.
Failed deliveries retry. If your endpoint is briefly down or returns an error, we don't just drop the event. We retry delivery on a backoff, so a short outage on your side doesn't mean lost data.
Turning webhooks on
Webhooks are self-serve. You set everything up yourself from the Webhooks page in your account settings (Settings → Webhooks), no need to talk to us first.
Register an endpoint. Add the URL on your server that should receive events. You can add more than one, edit them, or delete them at any time.
Choose your events. Pick which transaction and transfer events that endpoint should receive, so you only get what you actually care about.
Save your signing secret. We show the secret once when the endpoint is created. Copy it into your app so it can verify incoming deliveries, and rotate it later if you ever need to.
Watch delivery status. The Webhooks page shows recent deliveries so you can see what fired and whether it landed. If something's failing, you can pause an endpoint while you fix it and resume it when you're ready.
That's the whole loop: register, subscribe, verify, and you're getting live events.
Go deeper
For the exact event names, payload shape, signature-verification code, and retry behavior, head to the developer docs. They're the single source of truth and stay up to date with every release.
Want to read the records themselves? A webhook tells you an id, and then your app reads the full transaction from the API. See Reading card and external transactions from the API.