FloPay Backend Changelog

v1.10.29 - Webhooks tell merchants when a customer adds, removes or changes their default card on the hosted manage page #

Three new webhook events, payment_method.added, payment_method.removed and payment_method.default_changed, tell a merchant's systems when a customer changes their saved cards on the Flopay hosted manage page. Endpoints receive them only when subscribed. Existing events and integrations are unchanged.

A customer signed in to the Flopay hosted manage page can add a card, remove a card and choose their default card. Until now a merchant's systems were not told about these changes, so their records could drift from what the customer did. Flopay now sends a webhook for each change.

What changed

• payment_method.added is sent once when a card the customer added or replaced on the page has been saved.
• payment_method.removed is sent once when the customer removes a card on the page. A repeated or refused removal sends nothing.
• payment_method.default_changed is sent once when a card becomes the customer's default on the page, including a card added there that becomes the default automatically. It names the previous default card, the subscriptions that moved to the new default, and the subscriptions that stayed where they were with the reason. Choosing the card that is already the default, or a change that could not be made, sends nothing.
• A replaced card is reported as two events: the new card added and, when the customer removes it, the old card removed.

Why it matters

• A merchant's records of a customer's cards and default card stay in step with what the customer did on the hosted page.

Developer notes

• Add payment_method.added, payment_method.removed or payment_method.default_changed to the events of a webhook endpoint through POST /v1/webhooks or PATCH /v1/webhooks/{id} to receive them. Existing endpoints are not subscribed automatically.
• Payloads have objectType: "payment_method" and a paymentMethod object with the payment method id, client id, type and when the change happened. They never contain card numbers, expiry dates or other card details.
• Cards added, removed or changed through a merchant's own integration do not send these events.
• This release contains no breaking changes.