Outbound webhooks

Outbound webhooks push events from Senderz to your systems. Subscribe an endpoint to the events you care about and receive a signed POST whenever one fires.

Managing endpoints

Create endpoints in Settings → Integrations → Webhooks, or via the Public API (POST /public/webhooks). Creating an endpoint returns a signing secret once — store it; it’s not shown again.

url

string

required

Your HTTPS endpoint (max 1000 chars).

events

string[]

required

Event types to subscribe to (see the vocabulary below).

name

string

A label for the endpoint.

Event vocabulary

All 29 event types

Group	Events
Orders	`order.completed`, `order.refunded`, `order.fulfilled`, `order.partially_fulfilled`, `order.cancelled`
Shipping	`shipment.confirmed`, `shipment.out_for_delivery`, `shipment.delivered`
Checkout	`checkout.started`, `cart.abandoned`
Contacts	`contact.created`, `contact.updated`, `contact.unsubscribed`
Lists	`list.subscribed`, `list.unsubscribed`
Email	`campaign.sent`, `email.opened`, `email.clicked`
SMS	`sms.delivered`, `sms.failed`
Reviews	`review.request_ready`, `review.submitted`, `review.question`, `review.answer`
Loyalty	`loyalty.points_earned`, `loyalty.points_expiring`, `loyalty.tier_changed`, `loyalty.redemption`, `loyalty.referral`

Delivery & signature

Each delivery carries these headers:

Header	Meaning
`X-Sender-Signature`	`sha256=<hmac>` of the raw body, keyed by your signing secret
`X-Sender-Event`	The event type
`X-Sender-Delivery`	A unique delivery ID

Verify the signature

Compute HMAC-SHA256(rawBody, signingSecret) and compare (constant-time) against the X-Sender-Signature header’s hex digest.

Respond 2xx quickly

Acknowledge fast and process asynchronously.

Handle retries

Failed deliveries retry 5 times with backoff, then dead-letter. Deliveries are at-least-once — dedupe on X-Sender-Delivery.

Signature verification example

import crypto from "node:crypto";

function verify(rawBody, signatureHeader, secret) {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(signatureHeader);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Prefer Make.com for no-code consumption of these events — the Make integration manages the subscription lifecycle for you.

Make.com Inbound webhooks

⌘I

Overview

E-commerce

Automation & no-code

Advertising

AI

Outbound webhooks

Managing endpoints

Event vocabulary

Delivery & signature

Signature verification example

​Managing endpoints

​Event vocabulary

​Delivery & signature

​Signature verification example

Managing endpoints

Event vocabulary

Delivery & signature

Signature verification example