Webhooks

Get a signed HTTP POST on your server when something happens in the workspace.

Endpoints

How delivery works

Register an endpoint with Create a webhook and we POST a JSON event to it whenever one of its events happens. Respond with any 2xx within 10 seconds to acknowledge it.

A failed delivery is retried after 1 minute, 5 minutes, 30 minutes and 2 hours, then marked failed. Resend it from the delivery log or with Retry a delivery.

Verifying signatures

Each request carries X-ClickLookup-Event, X-ClickLookup-Delivery (unique per delivery, use it to drop duplicates) and X-ClickLookup-Signature: sha256= followed by an HMAC-SHA256 of the raw body, keyed with the endpoint’s secret. Compute it yourself and compare before trusting the payload.

Events

click.cap_reachedrotator_url.startedrotator_url.pausedrotator_url.finishedconversion.receiveddomain.verifieddomain.failedlink.destination_down

Event payload

{
  "event": "conversion.received",
  "workspaceId": "c2e84b19-6f3a-4d7c-8a5e-1b9f2d6e4a73",
  "occurredAt": "2026-09-22T10:15:00+00:00",
  "data": {
    "clickId": "3f6c2a1e-8b4d-4c2a-9e1f-5a7b3c9d2e10",
    "linkId": "9a1d7e42-3c5b-4f8e-b2a6-0d4e8f1c7b35",
    "rotatorId": null,
    "payout": 1.5,
    "currency": "USD",
    "eventType": "sale",
    "eventName": "purchase",
    "transactionId": "order-1042"
  }
}

Verify the signature

import crypto from "node:crypto";

// rawBody: the body exactly as received (a Buffer), before parsing.
function verify(rawBody, signature, secret) {
  const hmac = crypto.createHmac("sha256", secret).update(rawBody);
  const expected = "sha256=" + hmac.digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature ?? "");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}