Webhooks

Receive real-time HTTP callbacks for license events, product changes, and platform-wide admin activity.

Webhooks let your own infrastructure react instantly to events instead of polling the API. There are two levels:

Admin webhooks — platform-wide events such as logins, registrations, payments, and license checks. Configured by admins in Site Settings.
Product webhooks — events for a single product, such as license lifecycle changes and product updates. Configured by product owners on the product detail page.

Product webhooks

From any product detail page, open the Webhooks tab to add one or more HTTPS URLs. Each webhook can:

Choose which events to subscribe to, or subscribe to all events with *.
Set an optional secret used to sign deliveries.
Be enabled or disabled without deleting the configuration.

Product events

Event	Fired when
`license.created`	A new license is created for the product.
`license.updated`	A license is edited (status, expiry, feature flags, etc.).
`license.activated`	A license successfully checks in and creates or updates an activation.
`license.revoked`	A license is revoked.
`license.suspended`	A license is suspended.
`license.check`	A license check is performed for the product.
`product.updated`	The product's own settings are changed.
`sub_product.created` / `sub_product.updated` / `sub_product.deleted`	Sub-product changes.
`preset.created` / `preset.updated` / `preset.deleted`	Feature-flag preset changes.

Payload shape

json

{
  "event": "license.created",
  "timestamp": "2026-07-16T12:34:56.789Z",
  "payload": {
    "license_id": "...",
    "product_id": "...",
    "key": "PL-XXXX-XXXX-XXXX-XXXX",
    "status": "active"
  }
}

Admin webhooks

Admins can set a single platform webhook URL in Admin → Settings. Admin events include:

Event	Fired when
`admin.login`	An admin or seller logs in.
`admin.activity`	Sensitive admin actions (product/license/user mutations).
`payment.received` / `payment.failed`	A platform payment completes or fails.
`user.registered`	A new user registers.
`seller.registered`	A user completes seller onboarding.
`license.check`	Any license check across the platform.
`security.alert`	A security-relevant event such as repeated failed logins.

Signature verification

If a secret is configured, deliveries include:

http

X-Webhook-Event: license.created
X-Webhook-Signature: sha256=<hex>
Content-Type: application/json

Compute HMAC-SHA256 of the raw request body with your secret and compare it to the header value using a constant-time comparison. See the Account API for a code example.

Delivery behavior

Deliveries are fire-and-forget from the platform's perspective.
Timeouts are short (5 seconds) so webhooks never block user requests.
Failed deliveries are logged but not automatically retried.
Use HTTPS URLs only; plain HTTP URLs are rejected.

Best practices

Always verify signatures and reject unsigned or mismatched payloads.
Return a 2xx response quickly; defer heavy work to a background queue.
Use a unique secret per webhook and rotate it periodically.
Log webhook IDs or signatures so you can detect replayed payloads.