Webhooks

How Flick notifies you, and why you should not rely on the API response alone.

A 200 from a collection or payout endpoint means Flick accepted the request. Settlement happens afterwards, and Flick reports it with a webhook. If you treat the synchronous response as final you will mark payments complete that later fail.

​

Registering an endpoint

Set your webhook URL in the dashboard. It must be:

• served over HTTPS
• reachable from the public internet
• able to answer within a few seconds

Answer 2xx as soon as you have stored the event. Do the slow work afterwards.

​

What a delivery looks like

POST /your/webhook HTTP/1.1
Content-Type: application/json
flick-signature: <your webhook secret>

{
  "publicKey": "pk-...",
  "data": {
    "Id": "flickSII8rsaBgQ7DGrn9zNBDe",
    "status": "charge.success",
    "transaction_status": "success",
    "transaction_message": "settled",
    "time_to_settlement": "T+1",
    "account_number": "7540151440",
    "bank": "78 MFB",
    "fee": 400,
    "transaction_amount": 80000,
    "settled_amount": 79600,
    "currency": "NGN",
    "description": "merchant account funding",
    "channel": "Permanent-virtual-nuban",
    "merchant_name": "Acme Ltd",
    "transaction_ref": "flickSII8rsaBgQ7DGrn9zNBDe",
    "created_at": "2026-11-07T12:50:37.383Z"
  }
}

Amounts are in minor units. transaction_amount: 80000 is ₦800.00. Fees and settled amounts follow the same convention.

​

Deduplicate on Id

data.Id is stable for a given transaction. Flick suppresses a repeat delivery of the same Id, but network retries and your own infrastructure can still present one twice, so treat Id as an idempotency key on your side.

​

Replaying a delivery

If your endpoint was down, ask for a redelivery rather than reconciling by hand:

curl -X POST https://flickopenapi.co/merchant/resend-webhook \
  -H "Authorization: Bearer sk-..." \
  -H "Content-Type: application/json" \
  -d '{"transactionId": "flickSII8rsaBgQ7DGrn9zNBDe"}'

Verify every delivery

An unverified webhook endpoint will credit anyone who can guess its URL.