Instead of polling the API, a webhook tells you when something happens.
Setting up
Under Integrations → API → Webhooks you register:
- the URL that will receive;
- the events you want;
- and you get a secret, used to sign every delivery.
Available events
| Event | Fires when |
|---|---|
member.created | Someone joined the community |
member.removed | Someone left or was removed |
payment.paid | Payment confirmed |
payment.refunded | Payment refunded |
subscription.updated | A subscription changed state |
post.created | New post in the feed |
report.created | A report was opened |
crm.contact.created | New contact in the CRM |
crm.stage.changed | A contact moved stage |
crm.note.added | A note was written on a contact |
link.clicked | A tracked link was clicked |
Verify the signature. Always.
Every delivery is signed with HMAC SHA-256 using your secret. Without verifying, anyone who discovers your URL can send a fake payment.paid — and your system will grant access to someone who never paid.
Verify like this: recompute the HMAC of the raw body with your secret and compare it to the signature header. Different, discard.
Delivery log
Every attempt is recorded with the response code and the error, if any. That's how you find out your server was down at 3am — instead of finding out from a complaining customer.
Good practice
- Respond fast (2xx) and process afterwards. A slow endpoint becomes a failed delivery.
- Be idempotent: redelivery happens, and the same event can't become two grants of access.
- Don't trust the body without verifying the signature.