Webhook registration for updates on one-off payment statuses and subscription payment statuses.

[Optional] HMAC Verification

When this call creates a new webhook, the response includes a signing_secret. Mamo uses it to sign every delivery with an HMAC-SHA256 Mamo-Signature header. It is returned only once: it is not included in the Fetching Webhooks or Update Webhook responses, or when you call this endpoint again with the URL of an existing webhook (that only adds the new events to it). If you lose it, delete the webhook and create it again. See Webhook delivery & retries for how to verify the signature.

[Optional] Verify Mamo source IP

Every webhook delivery comes from one of these fixed IP addresses. Allowlist them on your firewall or check the request's source IP in your handler, then reject anything else.

Use this alongside the Mamo-Signature and auth_header checks, not instead of them. If your server sits behind a load balancer or proxy, check the original client IP it forwards (for example in X-Forwarded-For), not the proxy's own address.