> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sendler.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up webhooks

> Create a workspace subscription and verify incoming events with the Svix library.

## Create a subscription

1. Select the intended workspace and open **Integrations → Webhooks**.
2. Add a public HTTPS endpoint and choose the exact [event types](https://docs.sendler.ai/webhooks/overview.md#available-events).
3. Save the endpoint and securely obtain its signing secret from endpoint management.
4. Send a test event and inspect its delivery log.

Workspace owner/admin permissions govern subscription management. Keep the endpoint signing secret separate from SendPilot API keys and Clerk credentials.

## Verify a receiver

Install the libraries in your receiver application:

```bash theme={null}
bun add express svix
```

This minimal Express example verifies the delivery and logs its identifiers. In a production receiver, replace the log with a durable, idempotent enqueue/processing step before acknowledging success.

```javascript theme={null}
import express from 'express';
import { Webhook } from 'svix';

const secret = process.env.SENDPILOT_WEBHOOK_SECRET;
if (!secret) throw new Error('Set SENDPILOT_WEBHOOK_SECRET');
const verifier = new Webhook(secret);
const app = express();

// Register before express.json(): verification needs the original bytes.
app.post('/webhooks/sendpilot', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = verifier.verify(req.body.toString('utf8'), req.headers);
  } catch {
    return res.status(400).send('Invalid webhook');
  }

  console.info('Verified SendPilot event', event.eventId, event.eventType);
  return res.sendStatus(204);
});

app.listen(3000);
```

Do not JSON-parse and re-serialize the body before verifying it. The library validates the signature and timestamp and supports multiple signatures during key rotation. Follow the provider's actual rotation overlap; do not assume a fixed 24-hour overlap.

## Process events reliably

* Deduplicate using `eventId` before applying side effects.
* Validate the expected workspace and event type in your application.
* Make downstream updates idempotent; a delivery can be retried after a timeout.
* Return a non-2xx response if the event cannot be safely accepted for processing.
* Use current API state when an event alone is insufficient to resolve an outcome.

For local development, a public HTTPS tunnel can forward deliveries to your local receiver. Use test data and your own endpoint; switch the subscription to its production destination when ready.

## Manage deliveries and subscriptions

Use **Integrations → Webhooks** and its available endpoint management/delivery controls to test, inspect failures, update event filters, disable or delete an endpoint. Deleting a subscription does not recall events already delivered. Signature verification details and supported frameworks are documented by [Svix](https://docs.svix.com/receiving/verifying-payloads/how).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.