Webhooks

A webhook sends a JSON POST to your endpoint when something happens to one of your links. Webhooks are set up in your RoutePath.to account settings, not through the API. Pro includes 1 endpoint and Business includes 5.

Events

• link.created
• link.updated
• link.deleted
• link.clicked

Headers

• routepath-event — the event name.
• routepath-signature — hex HMAC-SHA256 of the raw request body, using your webhook's secret.

Verify the signature

Compute the HMAC of the raw body yourself and compare it to the header before trusting an event.

import { createHmac, timingSafeEqual } from "node:crypto";

// rawBody is the exact request body string, before any JSON parsing.
export function isValid(rawBody, signatureHeader, secret) {
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signatureHeader ?? "");
  return a.length === b.length && timingSafeEqual(a, b);
}

Good practice

• Respond with a 2xx quickly and do heavy work afterwards.
• Use the “send test” action in Settings to check your endpoint and signature handling.
• Rotate the secret from Settings if it may have leaked.
• Endpoints must be public http(s) URLs. An endpoint that keeps failing is disabled automatically.