Webhooks

Webhooks let ClickProbe notify your external systems — Slack, Microsoft Teams, Discord, or any HTTPS endpoint — when events occur in your account.

Creating a webhook

1. Go to Webhooks in the top navigation bar.
2. Click New webhook.
3. Paste your endpoint URL (e.g. a Slack Incoming Webhook URL).
4. Select the events you want to receive (see Event reference below).
5. Optionally scope the webhook to a specific project (leave as “All projects” for account-wide delivery).
6. Click Create webhook.

Important: The signing secret is shown once immediately after creation. Copy it to your password manager. ClickProbe cannot show it again.

Provider-specific notes

Event reference

Payload format

Every delivery has a canonical envelope:

{
  "event": "bug.created",
  "data": {
    "bug_id": "abc-123",
    "severity": "critical",
    "title": "[critical] Something is broken",
    "page_url": "https://app.example.com/dashboard",
    "session_id": "sess-456",
    "project_id": "proj-789",
    "app_url": "https://app.clickprobe.ai/app/bugs/abc-123"
  },
  "timestamp": "2026-04-21T09:30:00.123456+00:00"
}

Slack, Teams, and Discord payloads are reformatted by ClickProbe; generic receivers get the envelope above.

Signature verification

Every delivery carries three headers: X-ClickProbe-Event (the event type), X-ClickProbe-Delivery (a UUID, stable across retries of the same delivery — use it for idempotency), and X-ClickProbe-Signature: sha256=<hex>, where <hex> = HMAC_SHA256(your_secret, raw_body). Verify the signature using your stored secret, over the raw request body bytes (not parsed JSON), with a constant-time comparison:

import hmac
import hashlib

def verify(secret: str, body: bytes, signature_header: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)

const crypto = require("crypto");

function verify(secret, body, signatureHeader) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(body).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signatureHeader));
}

Retry behaviour

If your endpoint returns a non-2xx response, ClickProbe retries with exponential backoff:

Non-retriable responses (400, 401, 403, 404, 410, 422) are marked failed immediately.

Managing webhooks

• Active toggle — pause delivery without deleting the webhook.
• Send test — sends a test.ping event immediately to verify your endpoint is reachable.
• Delete — removes the webhook and all pending deliveries.