Webhooks

Supporting Cast offers REST webhooks to notify you when certain events occur.

Setup Guide

To implement the webhook system, follow these steps:

• Create a subscription to an event using the v1/webhooks API
• When the event occurs, we will send the details to the URL you specified. (See the 'callbacks' tab in the webhooks API docs for more details)
• Verify the signature to ensure the webhook is authentic.

Verifying Webhooks

We recommend configuring signed webhooks to ensure the webhooks you receive are authentic and to prevent unauthorized users from interacting with your site.

If you haven't already done so, add a new key in your admin under the Developer -> Signing Keys menu. Webhooks are automatically signed with the most recently created key.

When you have a signing key setup, all webhooks will contain two additional headers:

• Webhook-Signature - The signature of the webhook request body. The signature is a HMAC SHA256 hash and should be generated as a hex digest.
• Webhook-Signature-Key-ID - The ID of the signing key used.