Webhooks

Save reusable webhooks and attach them to one or more pages.

Saved webhooks

A webhook stores the name and URL for an external endpoint. Webhooks belong to an organization, so they can be reused across pages in that workspace.

Page assignments

Open a page's Webhooks link to attach saved webhooks to that page. The join record tracks page-specific delivery state, including when that page last sent that webhook.

Creating a webhook from a page

The page Webhooks screen includes a form for saving a new webhook and attaching it to the page in one step.

Verifying signatures

Each webhook has a signing secret. Delivery requests include X-Static-Pages-Api-Timestamp and X-Static-Pages-Api-Signature. Receivers should reject old timestamps, compute HMAC-SHA256 over timestamp.raw_body, and compare the result to the v1 signature using a constant-time comparison.

timestamp = request.headers.fetch("X-Static-Pages-Api-Timestamp")
signature = request.headers.fetch("X-Static-Pages-Api-Signature").delete_prefix("v1=")
expected = OpenSSL::HMAC.hexdigest("SHA256", signing_secret, "#{timestamp}.#{request.raw_post}")

valid = ActiveSupport::SecurityUtils.secure_compare(expected, signature)

Removing an assignment

Uncheck a webhook in the available webhooks table and save. This removes the page assignment without deleting the saved webhook.

Documentation, examples, prompts, templates, and API guidance are provided for authorized use with StaticPagesApi.