Webhooks

Partnerships

Platform partners integrate Infinite Giving into their product so nonprofits can accept stock and crypto donations.

See Authentication for the OAuth flow, and Webhooks for event payloads.

Who calls what. Your partner backend calls the subscription APIs. You use an OAuth access token issued to your client after a nonprofit admin consents. The :organization_id in those routes is the nonprofit’s organization (the customer you connected), not your partner org.

Partner onboarding

Before you can connect nonprofits, your company needs an Infinite Giving account and a partnership kickoff with our team. We configure your OAuth client and webhook delivery — you do not set this up yourself in the API.

What you provide

Item Description
OAuth callback URL HTTPS endpoint on your server that receives the authorization code after a user consents (must match exactly what we register).
Webhook URL HTTPS endpoint where we POST donation events (donation:created, donation:updated).
OAuth logo Upload your logo in your partner organization’s Infinite Giving account settings. We use it on the consent screen and referral branding. Update it before kickoff if possible — changing it later may require us to sync your OAuth client.

What we provide at kickoff

  • OAuth client ID and client secret (shared out-of-band; never returned by the token API)
  • Webhook signing secret (shared out-of-band; used to verify incoming deliveries)
  • Integration display name, referral code, and referral signup link (if applicable)

Credentials are issued per environment. You will normally be set up in sandbox first and receive a separate client ID, secret, and signing secret for production once your integration is verified — see Environments. URLs on this page use the production hosts; substitute the sandbox hosts while developing.

Contact support@infinitegiving.com to start partner onboarding.

Referral signup (preferred)

Share a referral link so new organizations are attributed to you at signup. After they complete IG onboarding, we may auto-connect them for webhook delivery.

https://auth.infinitegiving.com/signup?ref=YOUR_REFERRAL_CODE&return_uri=URL_ENCODED_OAUTH_AUTHORIZE_URL

Public branding for the signup page. Note this endpoint is on the auth host, not the API host, and needs no authentication: 

GET https://auth.infinitegiving.com/referrals/:referral_code/public

{ "name": "Your Integration", "logo": "https://..." }

Returns 404 { "error": "not_found", "message": "Unknown referral code" } for an unrecognized code. logo is null if your partner organization has not uploaded one.

Connect a customer

Webhook delivery starts only after a customer is connected to your partner app. Use this for existing or non-referred customers (and safely after OAuth even when referral auto-connect applies).

Customer authorizes your app

Complete the OAuth authorization code flow and obtain an access token with webhooks:read and webhooks:write scopes.

Identify the organization

The token response includes ig_organizations — a list of { id, name }. Usually one entry; if the user owns several organizations, ask them to pick one.

Connect the organization

Call the partner-subscriptions endpoint (empty body). This is required for non-referred customers.

Receive donation events

We POST donation events to the webhook URL configured at kickoff.

Connect (required for non-referred customers) 

POST /v1/organizations/:organization_id/partner-subscriptions
Authorization: Bearer YOUR_ACCESS_TOKEN
Content-Type: application/json

{}

YOUR_ACCESS_TOKEN is the partner OAuth token from the consent flow above. :organization_id is that nonprofit’s id. Safe to retry. Subscribes the organization to donation:created and donation:updated.

Where :organization_id comes from. The OAuth token response names the customer organization, so your callback can connect without any out-of-band lookup: 

{
  "access_token": "...",
  "ig_organizations": [{ "id": "01HZX...", "name": "Example Nonprofit" }]
}

ig_organizations is always a list. One entry is the common case — connect it. If the user owns more than one eligible organization you get several entries rather than a guess, so prompt them to choose and connect that id. An empty list means the user owns no eligible organization; contact your Infinite Giving representative. See Authentication for the full token response.

Required scopes

Partner tokens carry scopes that gate the partner-subscriptions routes. Reads accept either scope; writes require webhooks:write.

Scope Grants
webhooks:read List and read subscriptions and delivery history
webhooks:write Connect and disconnect subscriptions, and redeliver events (includes read access)

Manage subscriptions 

GET    /v1/organizations/:organization_id/partner-subscriptions
GET    /v1/partner-subscriptions/:id
DELETE /v1/partner-subscriptions/:id

Association model

A subscription is tied to both a nonprofit organization and your OAuth client:

  • You only see subscriptions belonging to your own OAuth client — a token from one integration cannot read or modify another's, even for the same nonprofit.
  • You only receive donation events for organizations that authorized you.
  • Delivery always uses the webhook URL and signing secret configured for your OAuth client at kickoff. Subscriptions carry neither; they track only which events flow for that customer.

Disconnecting

DELETE /v1/partner-subscriptions/:id stops delivery for that organization. Reconnecting later with the same connect call restores it, so disconnect is safe to use for pausing. Customer-facing disconnect in the nonprofit's organization settings may be added later.

Delivery history 

GET  /v1/partner-subscriptions/:id/deliveries
GET  /v1/deliveries/:id
POST /v1/deliveries/:id/redeliver
Previous
Crypto
Next
Webhooks