Guides

Webhooks

Add an https endpoint under Developers → Webhooks and choose its events. We POST one JSON event per call.

We POST JSON to your https endpoint. Answer with any 2xx within 10 seconds. Anything else is retried after 1 min, 5 min, 30 min, 2 h and 6 h, then every 12 h until 3 days after the first try; then the endpoint is paused and the owner is told. The same event can arrive twice: use id to do the work once.

Headers

• HivePost-SignaturestringRequired

  t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">, made with the endpoint's signing secret (whsec_…, shown once when you add the endpoint or roll the secret). Check it against the raw body before you parse it, and refuse times more than 5 minutes away.

• HivePost-EventstringRequired

  The event's type, the same as type in the body.

  One of post.published, post.failed, account.connected, account.disconnected

• HivePost-DeliverystringRequired

  This delivery's id; the same on every retry of it.

• HivePost-AttemptstringRequired

  1 for the first try, then 2, 3 and so on.

Check the signature

HivePost-Signature is t=<unix seconds>,v1=<hex>: an HMAC-SHA256 of <t>.<raw body> with the endpoint's signing secret (whsec_…). Check it on the raw body before parsing, and refuse times more than 5 minutes away. The Node code is on the right.

Events