Green Dot Webhooks

Green Dot Embedded Finance (Banking-as-a-Service) does not use the Standard Webhooks spec or a single HMAC signature. It uses push authentication: Green Dot authenticates itself to your partner-hosted endpoint. The primary model is an OAuth 2.0 client_credentials Bearer token (scope post:webhook) sent on every delivery, with a Certificate (mTLS) variant as an alternative.

When to Use This Skill

• How do I receive Green Dot Embedded Finance / BaaS webhooks?
• How do I authenticate the Green Dot OAuth Bearer token on my endpoint?
• What is the x-gd-signature header and can I verify it?
• How do I echo the x-GD-RequestId header and return responseDetails?
• How do I handle transaction, accountUpdated, or achTransfer events?
• Why does Green Dot keep retrying my webhook endpoint?

Verification (core)