Webhooks

Set up

Go to Settings → Workspace → Webhooks, add your https endpoint, and pick the events. Use Send test to send a test.ping.

Events

Event	When
lead.created	A lead was recorded
sale.created	A sale was recorded
sale.refunded	A sale was refunded
commission.created	A partner earned commission
partner.created	A partner was added
payout.paid	A partner payout was paid

Payload

{
  "id": "evt_5f3c…",
  "type": "sale.created",
  "data": { "conversionId": "…", "amountCents": 4999, "currency": "USD", "referrerId": "…" },
  "createdAt": "2026-09-15T18:04:11.000Z"
}

Header	Value
X-Bridgly-Signature	HMAC-SHA256 (hex) of the raw body, signed with your endpoint's secret
X-Bridgly-Event	The event type
X-Bridgly-Delivery	The event id. It stays the same across retries, so use it to skip duplicates
X-Bridgly-Attempt	1, 2, …

Verify the signature

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyBridgly(rawBody: string, signature: string, secret: string) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  return expected.length === signature.length &&
    timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Read the body as a raw string before parsing it as JSON. Re-serialised JSON won't match the signature.

Delivery

• Respond with a 2xx within 8 seconds.
• Anything else is retried after 30 seconds, 5 minutes and 30 minutes. A 4xx (other than 408 and 429) isn't retried, because it means the request itself was rejected.
• After 10 failed events in a row the endpoint is turned off. Turn it back on from the same settings page once it's fixed.
• Every attempt, with its request and response, is in the delivery log for 30 days.