Skip to Content
v1.5Official documentation for the LX CloudPos API · stable in production
v1.5 (current)WebhooksWebhook configuration

Webhook configuration

Webhooks are configured at the API key level. When creating (or rotating) it, the tenant administrator defines:

  • webhookUrl — the public HTTPS URL where LX CloudPos will make the POST.
  • webhookSecret — shared secret for HMAC-SHA256. It is shown only once when creating or rotating the key; it must be stored in the appropriate secrets manager before closing the screen.

webhookUrl requirements

Allowed:

  • HTTPS only (http:// is rejected).
  • Public domains (tu-app.com, api.tu-empresa.cr).
  • Any path (/webhooks/lxs, /api/notifications/lxs-cloudpos).

Blocked (SSRF protection):

  • localhost and 127.0.0.0/8.
  • 0.0.0.0.
  • RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Link-local (169.254.0.0/16 — includes the cloud metadata endpoint).
  • CGNAT (100.64.0.0/10).
  • IPv6 loopback, link-local, and site-local.

To test against localhost during development, use a public tunnel; see local webhook testing.

Webhook conceptsWebhook payload