Webhooks & signatures
Register endpoints and verify signed deliveries
Admin routes under /api/developer/webhooks manage outgoing endpoints. Delivery uses a 10-second timeout, does not follow redirects, and blocks private targets unless ALLOW_LOCAL_WEBHOOKS=true.
Signature
X-ChatFleet-Signature is t={unix},v1={hex HMAC}. Sign the exact bytes of "timestamp.raw_body" with the whsec_ secret.
Management routes
Admin browser session required.
- GET/POST /api/developer/webhooks
- DELETE /api/developer/webhooks/{id}
- POST /api/developer/webhooks/{id}/test
- GET /api/developer/webhooks/deliveries
Current events
Events produced by implemented flows.
- message.sent
- contact.created
- ticket.created
- message.received (test payload)
Verify in Node.js
Use raw bytes; do not parse and re-stringify before verification.
const parts = Object.fromEntries(signature.split(',').map(p => p.split('=')));
const expected = crypto.createHmac('sha256', secret)
.update(parts.t + '.').update(rawBody).digest('hex');Inbound ingest
The ingest server separately exposes GET/POST /webhook/meta and POST /webhook/form. Meta POST validates X-Hub-Signature-256.