Help Center / Set up webhooks

Set up webhooks

A webhook lets you react to a backing the second it happens — ping a Discord channel, trigger a stream overlay, or write it into your own database. It’s on every plan.

Open Settings and find Webhooks.
Paste your endpoint into Webhook URL. It must be https:// and publicly reachable — localhost and private network addresses are rejected. Discord and Slack need no code: paste the incoming-webhook URL from the channel’s settings and we send their format, so every new sponsor posts straight into the channel with their name, tier and message.
Press Save webhook. A signing secret is generated for you.
Copy the secret into your server and verify every request with it (code below).

What we send

A POST with JSON, for one-time backings and every monthly renewal. There is one event type, sponsorship.paid; the recurring flag tells the two apart.

{ "event": "sponsorship.paid", "dispatched_at": "2026-03-04T10:15:00.000Z", "data": { "sponsorship_id": "...", "creator_username": "you", "sponsor_display_name": "Priya Raman", "sponsor_message": "Love the work", "amount_cents": 15000, "platform_fee_cents": 7500, "creator_net_cents": 142500, "currency": "usd", "visibility": "public", "recurring": true, "created_at": "2026-03-04T10:15:00.000Z" } }

Verifying the signature

Every request carries a header:

X-SponsoredBy-Signature: sha256=<lowercase hex>

That’s an HMAC-SHA256 of the raw request body, using your signing secret as the key.

The detail that trips people up: your secret is displayed as a 64-character hex string, but the key is the 32 raw bytes it decodes to — not the hex text. If you use the string directly the signatures will never match.

// Node.js const crypto = require('crypto'); function verify(rawBody, header, secretHex) { const key = Buffer.from(secretHex, 'hex'); // decode first const expected = 'sha256=' + crypto .createHmac('sha256', key) .update(rawBody) .digest('hex'); return crypto.timingSafeEqual( Buffer.from(expected), Buffer.from(header) ); }

Delivery behaviour

We wait 7 seconds for a response, and retry once after about 1.5 seconds if we get an error or a non-2xx.
After that the delivery is dropped — there’s no queue or replay, so return a 2xx quickly and do slow work afterwards.
Redirects are never followed. Point us at the final URL.

Rotating the secret

Press Rotate secret to generate a new one. It takes effect immediately and there’s no overlap window, so update your server at the same time — otherwise deliveries will fail signature checks until you do.

← All articles · Contact support