Configure customer webhooks

Supported customer events

The customer form offers job finished, invoice issued and quota threshold events. Select only events your receiver handles. Endpoints belong to your personal or selected organisation context. Organisation owners and administrators can manage them; members may view but not change them. A webhook sends notifications and cannot itself change an order or invoice.

1. Open Webhooks in the intended organisation context.
2. Select at least one event your receiver supports.
3. Use separate endpoints for distinct environments.

Register a public destination

Create an endpoint with a 2–120 character name, valid URL and one or more listed events. HTTPS and a public hostname are required. Local, internal and private IP destinations are rejected, so a local development URL will not work. Submit after the receiver can accept JSON and return a successful HTTP response.

1. Deploy a receiver at a stable public HTTPS address.
2. Enter its URL, clear name and event selections.
3. Submit once and correct any validation errors.

Verify signed messages

Creation reveals a signing secret once. Requests contain event, delivery, timestamp and HMAC signature headers plus JSON with event ID, type, creation time and data. Validate the signature over the timestamp and exact raw body, enforce a reasonable timestamp window, and handle duplicate IDs idempotently. Keep the secret out of logs and support messages.

1. Store the secret in protected receiver configuration.
2. Verify signature against the unmodified request body.
3. Record event IDs to prevent duplicate business actions.

Read delivery history

The page shows the latest 50 deliveries across your endpoints. Successful HTTP responses are marked succeeded. Server errors and rate limits can be retried; other unsuccessful responses can fail immediately, and attempts stop at the retry limit. History includes response status and a bounded response body or error. An event may not appear if it did not occur or the endpoint did not subscribe.

1. Inspect event, attempt count, status and last error.
2. Fix receiver availability, response or rate limiting.
3. Check a later delivery for succeeded state.

Rotate the signing secret

Rotation replaces the endpoint secret and reactivates that endpoint. Receivers using only the old value will reject new requests. Prepare an update to receiver configuration, rotate from the intended endpoint row, capture the new value and deploy it promptly. If compromised, rotate at once and inspect delivery history for unexpected activity.

1. Identify receiver instances and prepare secure deployment.
2. Rotate the endpoint and store the one-time secret.
3. Confirm a subsequent expected delivery succeeds.

Replace or revoke endpoints

The customer controls create, rotate and revoke; there is no edit action for URL or event selection. To change either, create a replacement, verify it receives the correct events, then revoke the previous endpoint. Revocation stops future deliveries and marks it inactive. Use this for retired destinations or compromised secrets, and verify the list after action.

1. Create a replacement with corrected URL or event set.
2. Confirm the replacement delivery succeeds.
3. Revoke the old endpoint and verify it is inactive.

Frequently asked questions

Related pages

• Understand pricing before you order
• Place and track customer orders
• View subscriptions and billing
• Create and protect API keys
• Manage organisation membership
• Manage notifications
• Manage profile, security and privacy