Follow these practices so deliveries stay reliable and your books stay consistent.

Handle duplicate events

Delivery is at least once. The same resource state can arrive more than once, including after you retry events. Before you credit, debit, or otherwise apply the event, check the resource identifier (fid, wid, or payload.id) and its status so a later state change is not treated as a duplicate.

Process asynchronously

Return 2xx as soon as you have persisted the body. Do the rest of the work on a queue. Endpoints that take more than five seconds time out and look like a failed delivery.

Verify signatures

Reject any request whose signature does not verify. See Webhook Signatures and List webhook public keys.

Allowlist Bitso source IPs

Your endpoint should accept webhook traffic only from these addresses:

Use HTTPS callback URLs

Create webhook subscriptions and Update a webhook callback URL require an HTTPS callback URL, for example https://example.com/hooks/bitso. The URL must be reachable from the public internet.