> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senderz.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Outbound webhooks

> Subscribe to Senderz events and receive signed HTTP deliveries at your endpoint.

Outbound webhooks push events from Senderz to your systems. Subscribe an endpoint to the events you care about and receive a signed POST whenever one fires.

## Managing endpoints

Create endpoints in **Settings → Integrations → Webhooks**, or via the [Public API](/en/api-reference/webhooks) (`POST /public/webhooks`). Creating an endpoint returns a **signing secret once** — store it; it's not shown again.

<ParamField path="url" type="string" required>
  Your HTTPS endpoint (max 1000 chars).
</ParamField>

<ParamField path="events" type="string[]" required>
  Event types to subscribe to (see the vocabulary below).
</ParamField>

<ParamField path="name" type="string">
  A label for the endpoint.
</ParamField>

## Event vocabulary

<Accordion title="All 29 event types" icon="list">
  | Group    | Events                                                                                                               |
  | -------- | -------------------------------------------------------------------------------------------------------------------- |
  | Orders   | `order.completed`, `order.refunded`, `order.fulfilled`, `order.partially_fulfilled`, `order.cancelled`               |
  | Shipping | `shipment.confirmed`, `shipment.out_for_delivery`, `shipment.delivered`                                              |
  | Checkout | `checkout.started`, `cart.abandoned`                                                                                 |
  | Contacts | `contact.created`, `contact.updated`, `contact.unsubscribed`                                                         |
  | Lists    | `list.subscribed`, `list.unsubscribed`                                                                               |
  | Email    | `campaign.sent`, `email.opened`, `email.clicked`                                                                     |
  | SMS      | `sms.delivered`, `sms.failed`                                                                                        |
  | Reviews  | `review.request_ready`, `review.submitted`, `review.question`, `review.answer`                                       |
  | Loyalty  | `loyalty.points_earned`, `loyalty.points_expiring`, `loyalty.tier_changed`, `loyalty.redemption`, `loyalty.referral` |
</Accordion>

## Delivery & signature

Each delivery carries these headers:

| Header               | Meaning                                                       |
| -------------------- | ------------------------------------------------------------- |
| `X-Sender-Signature` | `sha256=<hmac>` of the raw body, keyed by your signing secret |
| `X-Sender-Event`     | The event type                                                |
| `X-Sender-Delivery`  | A unique delivery ID                                          |

<Steps>
  <Step title="Verify the signature">
    Compute `HMAC-SHA256(rawBody, signingSecret)` and compare (constant-time)
    against the `X-Sender-Signature` header's hex digest.
  </Step>

  <Step title="Respond 2xx quickly">
    Acknowledge fast and process asynchronously.
  </Step>

  <Step title="Handle retries">
    Failed deliveries retry 5 times with backoff, then dead-letter. Deliveries
    are at-least-once — dedupe on `X-Sender-Delivery`.
  </Step>
</Steps>

## Signature verification example

```javascript theme={null}
import crypto from "node:crypto";

function verify(rawBody, signatureHeader, secret) {
  const expected =
    "sha256=" +
    crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(signatureHeader);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}
```

<Note>
  Prefer **Make.com** for no-code consumption of these events — the
  [Make integration](/en/integrations/make) manages the subscription
  lifecycle for you.
</Note>