Skip to main content
POST
Register a notification webhook (free)

Authorizations

Authorization
string
header
required

Firebase ID token from /auth or any paid route, sent as a Bearer token: Authorization: Bearer <id_token> (the Bearer prefix is required).

Headers

Idempotency-Key
string

Optional client-generated unique key (a UUID works) that makes this write safe to retry. A retry with the same key within 24 hours returns the recorded response of the original request, marked with an Idempotency-Replayed: true header, instead of performing the write again. Reusing a key with a different body or route is rejected with 422 (code: idempotency_key_reused); a retry that arrives while the original is still running gets 409 (code: idempotency_key_in_progress), so wait a moment and retry with the same key. Keys are scoped to the authenticated account.

Maximum string length: 255

Body

application/json
url
string
required

Public HTTPS URL to receive signed notification POSTs. Max 512 characters. Private/internal hosts are rejected.

Response

Webhook registered

registered
boolean
url
string
secret
string

Standard Webhooks signing secret (whsec_...). Shown only in this response — store it now. Rotate by re-registering.

signing
string

Always standard-webhooks.