Webhooks

Add an endpoint

Under Settings → Developers, add an https address and pick the events: a contact created, a tag added, a message received, a sale recorded, a booking canceled and more. Copy the signing secret; it is shown once.

Verify the signature

Each request carries `X-ChatinFlow-Signature: t=<unix time>,v1=<signature>`. Compute HMAC-SHA256 of `<t>.<raw body>` with the secret, compare it with `v1` in constant time, and refuse timestamps older than five minutes.

signature = hex(hmac_sha256(secret, t + "." + raw_body))
valid = equals(signature, v1) and now - t < 300

Answer fast and drop repeats

Reply with any 2xx within 10 seconds. A failed delivery is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours. Delivery is at least once: `X-ChatinFlow-Delivery` stays the same across retries, so skip ids you already handled.

Stopped endpoints

After 50 failed attempts in a row, or an answer of 410 Gone, the endpoint stops and shows why. Fix it, turn it back on, and resend failed deliveries from the log.

Zapier, Make and n8n

Create an endpoint for the event you need and paste the catch-hook address of your Zap or scenario. `GET /api/v1/workspaces/<workspace>/webhooks/events` lists every event with a sample payload for mapping fields.

Connect the channel first

OAuth or credential connect under Dashboard → Channels registers the webhook path and secrets. You do not manually paste Meta callback URLs for the first-party product.

Idempotent ingest

Provider deliveries are deduped using Idempotency-Key or provider message ids so retries do not double-create conversations.

Permission loss

If scopes are revoked, Channels surfaces reauth. Fix permissions before debugging “missing webhooks”.