Webhooks

Webhooks push conversation events to your endpoint as they happen, so you don't have to poll. Each delivery is signed so you can verify it came from EveryChan.

Subscribe

Add an endpoint under Settings → Developers → Webhooks, or via the API. The signing secret is returned once on creation — store it.

POST /api/webhooks
Authorization: Bearer YOUR_TOKEN
Content-Type: application/json

{
  "url": "https://your-app.com/webhooks/everychan",
  "events": ["chat.created", "message.created", "chat.closed"]
}

# → { "data": { "id": "…", "url": "…", "secret": "whsec_…" } }

Events

Payload & headers

Each event is a POST with a JSON body and these headers:

POST /webhooks/everychan
X-EveryChan-Event: chat.created
X-EveryChan-Signature: <hex hmac-sha256 of the raw body>
Content-Type: application/json

{ "event": "chat.created",
  "data": { "chatId": "…", "channel": "WEB", "contactId": "…" } }

Verify the signature

Compute an HMAC-SHA256 of the raw request body using your webhook secret and compare it, in constant time, to X-EveryChan-Signature.

import crypto from "node:crypto";

function verify(rawBody, signature, secret) {
  const expected = crypto.createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

Reject the request if the signatures don't match.

Building a full app instead of a single endpoint? Attach webhooks to an OAuth installation so they follow the install.