Webhooks

eldo wallet can call your server when an event happens in your wallet.

Events

Event	Trigger
client.created	Customer created (API, bulk operation, public sign-up form, CSV import)
client.updated	Customer updated, including their points (gain)
client.deleted	Customer deleted
pass.installed	A phone added the pass to Apple Wallet or Google Wallet
pass.uninstalled	A phone removed the pass

Configure the URL

Set webHookUrl on your wallet with PATCH/wallets. Separate multiple URLs with commas.

Set the webhook URL

PATCH/walletsTry it →

• curl
• SDK Node.js
• nodejs
• php
• python
• java
• csharp
• go
• ruby

• CURL

curl -L -X PATCH 'https://api-v2.test.eldowallet.fr/wallets' \
-H 'Accept: application/json' \
-H 'x-lang: en' \
-H 'Authorization: Bearer <token>' \
-F 'webHookUrl="https://your-server.example.com/hooks/eldo\#headers=Authorization:Bearer%20my-shared-secret"'

Authenticate the calls

Webhooks aren't signed. To check that a call comes from eldo wallet, add your own headers with the #headers= fragment: Name:Value, comma-separated, with URL-encoded values. eldo wallet sends them with every call, and never shows them again when you read the wallet back.

Check this header on your server and reject calls that don't carry it.

Format

POST, Content-Type: application/json:

{
  "event": "pass.installed",
  "walletId": "6650a0b1c2d3e4f5a6b7c8d9",
  "timestamp": "2026-11-20T10:02:13.408Z",
  "data": {
    "pass": {"_id": "6651b2…", "kind": "TRANSIT", "status": "active", "barcode": "MRS-AJA-000123", "activeIOSDeviceCount": 1, "activeAndroidDeviceCount": 0},
    "barcode": "MRS-AJA-000123",
    "deviceType": "IOS"
  }
}

For client.*, data.client contains the full customer (_id, firstName, lastName, email, phoneNumber, barcode, source, gain…).

Delivery and retries

• Respond with a 2xx within 10 seconds. Do any heavy processing after responding.
• On failure, eldo wallet retries 3 times with an increasing delay (starting at 2 s).
• The same event can arrive more than once, and order isn't guaranteed: make your handler idempotent (for example on event + data.pass._id + timestamp).

// Express
app.post('/hooks/eldo', express.json(), (req, res) => {
  if (req.get('Authorization') !== `Bearer ${process.env.ELDO_WEBHOOK_SECRET}`) return res.sendStatus(401);
  res.sendStatus(204); // respond right away
  queue.push(req.body); // process later
});

Bulk operation completion webhook

The /bulk endpoints accept a per-request webhookUrl, called only once at the end. See bulk operations.