Get a signed POST to your own server the moment something happens in your account.
We'll POST events to this https URL.
Events to send
Each POST is signed so you can confirm it really came from us.
We send X-BackOnTools-Signature: sha256=<hex>, an HMAC-SHA256 of the raw request body, keyed by your signing secret. Recompute it and compare.
// Node (Express)
import crypto from "crypto";
app.post("/webhooks/backontools", express.raw({ type: "application/json" }), (req, res) => {
const sig = req.header("X-BackOnTools-Signature");
const expected = "sha256=" +
crypto.createHmac("sha256", process.env.BOT_WEBHOOK_SECRET)
.update(req.body) // the RAW body, not parsed JSON
.digest("hex");
if (sig !== expected) return res.status(401).end();
const { event, data, timestamp } = JSON.parse(req.body);
// … handle event …
res.sendStatus(200); // 2xx = delivered; anything else retries
});Failed deliveries (non-2xx or unreachable) are retried with exponential backoff. Reply 2xx to acknowledge.