Step 2: Create a webhook subscription

Each application can have multiple subscriptions associated to it. While one subscription is sufficient, you can create up to ten for redundancy.

Security considerations:

Your webhook endpoint should only be accessible over TLS (HTTPS) and your server should have a valid certificate. Your subscription should include a random, secret key, only known by your application. This secret key should be securely stored and used later when validating the authenticity of the webhook request from Dwolla.

var requestBody = {
  url: "http://myawesomeapplication.com/destination",
  secret: "your webhook secret",
};

applicationToken
  .post("webhook-subscriptions", requestBody)
  .then((res) => res.headers.get("location")); // => 'https://api-sandbox.dwolla.com/webhook-subscriptions/5af4c10a-f6de-4ac8-840d-42cb65454216'

You can retrieve your newly created subscription by its resource location:

var webhookSubscriptionUrl =
  "https://api-sandbox.dwolla.com/webhook-subscriptions/5af4c10a-f6de-4ac8-840d-42cb65454216";

applicationToken.get(webhookSubscriptionUrl).then((res) => res.body.created); // => '2016-04-20T15:49:50.340Z'