Signed payloads
Each delivery carries X-Webhook-Id, X-Webhook-Timestamp and X-Webhook-Signature. Verify the raw body with the signing secret shown when you create the endpoint.
Signed webhooks
Line moves, pushed to your server.
Subscribe a public HTTPS endpoint to offer events. Every delivery is signed with HMAC-SHA256 and retried until your server accepts it.
Deliver the change
Trigger workflows the moment a line moves, without polling from every service.
- 1Register an HTTPS endpoint
- 2Verify the signature
- 3Acknowledge with a 2xx
POST to your endpoint · Productionimport { createHmac, timingSafeEqual } from 'node:crypto';
// rawBody is the exact request body, before JSON parsing.
const expected = 'v1=' + createHmac('sha256', signingSecret)
.update(timestamp + '.' + rawBody).digest('hex');
const received = Buffer.from(signature);
const wanted = Buffer.from(expected);
const valid = received.length === wanted.length &&
timingSafeEqual(received, wanted);
// Reject timestamps older than five minutes; dedupe on X-Webhook-Id.Key facts
Automatic retries
Failed deliveries are retried up to five attempts. The workspace shows every attempt and its response code.
Production plan
Webhooks are included with Production. Register and manage endpoints in your workspace.
Works well with
Implementation guideChange feed
Sync an application cache and drive alerts from line moves in near real time.
GET /api/v1/changesLine history
Build line charts, replay a slate, or audit exactly when an alert should have fired.
GET /api/v1/projections/{id}/historyAPI workspace
Run your integration with clear limits and credentials you can rotate in seconds.
Dashboard · Keys · Usage