Token.io Webhooks

When to Use This Skill

• How do I receive Token.io webhooks?
• How do I verify the Token.io token-signature Ed25519 signature?
• Why is my Token.io webhook signature verification failing?
• How do I subscribe to webhooks with PUT /webhook/config?
• How do I handle PAYMENT_STATUS_CHANGED, REFUND_STATUS_CHANGED, VRP_STATUS_CHANGED, or VIRTUAL_ACCOUNT_CREDIT_RECEIVED events?
• What do the payment statuses INITIATION_PROCESSING, INITIATION_COMPLETED, and INITIATION_REJECTED mean?

How Token.io Webhooks Work (Read This First)

Token.io is an open banking / account-to-account (A2A) payments provider. Its webhooks are not HMAC and not Standard Webhooks. Every delivery is signed with an asymmetric Ed25519 signature:

• token-signature — the Ed25519 signature of the raw POST body, base64url encoded.
• token-event — the event type, e.g. PAYMENT_STATUS_CHANGED (a separate header, not a body field).