Webhooks Reference

Real-time event delivery

Get notified instantly when things happen in your community. HMAC-signed payloads, automatic retries with exponential backoff, and full delivery logs.

Overview

Webhooks send HTTP POST requests to your server when events occur in your community. Create them from Admin → Developer API → Webhooks tab.

Each webhook endpoint gets its own unique signing secret. You can have up to 25 webhooks per community, and each can subscribe to all events or a specific subset.

Setup

  1. Go to Admin → Developer API → Webhooks tab
  2. Click Create Webhook
  3. Enter a name (e.g., "Slack Notifications") and your HTTPS endpoint URL
  4. Select which events to subscribe to (or leave empty for all events)
  5. Save the signing secret securely — it's shown only once
  6. Click Test to send a test ping and verify delivery

Payload Format

Every webhook delivery is a JSON POST request with a consistent envelope structure.

Webhook Payload
{
  "event": "member.joined",
  "timestamp": "2026-03-28T14:30:00Z",
  "communityId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "data": {
    "memberId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
    "displayName": "Jane Smith",
    "email": "jane@example.com",
    "planName": "Pro Monthly"
  }
}
FieldTypeDescription
eventstringThe event type in dotted notation (e.g. member.joined)
timestampstringISO 8601 UTC timestamp of when the event occurred
communityIdstringGUID of the community where the event occurred
dataobjectEvent-specific data — varies by event type

Delivery Headers

Every webhook delivery includes these custom headers for verification and debugging.

X-MemberPad-Signature
HMAC-SHA256 signature: sha256={hex_digest}
X-MemberPad-Event
Event type (e.g. member.joined)
X-MemberPad-Delivery
Unique delivery ID (GUID) for tracking
X-MemberPad-Timestamp
ISO 8601 timestamp of the delivery attempt
Content-Type
application/json
User-Agent
MemberPad-Webhook/1.0

Verifying Signatures

Always verify the X-MemberPad-Signature header to ensure the payload was sent by MemberPad and hasn't been tampered with. Compute the HMAC-SHA256 of the raw request body using your webhook's signing secret and compare.

import crypto from "crypto";
import express from "express";

const SECRET = "whsec_your_signing_secret";
const app = express();

// Use raw body for accurate HMAC computation
app.use(express.json({
  verify: (req, res, buf) => { req.rawBody = buf; }
}));

app.post("/webhooks/memberpad", (req, res) => {
  const signature = req.headers["x-memberpad-signature"];
  const expected = "sha256=" + crypto
    .createHmac("sha256", SECRET)
    .update(req.rawBody)
    .digest("hex");

  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  )) {
    return res.status(401).send("Invalid signature");
  }

  // Signature valid — process the event
  const { event, data } = req.body;
  console.log(`Received: ${event}`, data);

  // Return 200 quickly — do heavy work asynchronously
  res.status(200).send("OK");
});

app.listen(3000);
Use timing-safe comparison. Always use timingSafeEqual (Node.js), hmac.compare_digest (Python), or constant-time comparison to prevent timing attacks.

Retries & Exponential Backoff

If your endpoint returns a non-2xx status code, times out (10 seconds), or is unreachable, MemberPad will retry the delivery with exponential backoff.

1
Attempt 1
Immediate
2
Attempt 2
+1 minute
3
Attempt 3
+5 minutes
4
Attempt 4
+30 minutes
5
Attempt 5
+2 hours

After 5 failed attempts, the delivery is marked as Exhausted. You can manually retry any failed or exhausted delivery from the admin panel at any time.

SpecValue
Max attempts5
Timeout10 seconds per attempt
SuccessAny 2xx HTTP status code
FailureNon-2xx status, timeout, or connection error
RedirectsNot followed (returns the redirect status as a failure)

Best Practices

  • Return 200 immediately. Do heavy processing asynchronously. MemberPad waits only 10 seconds before timing out.
  • Verify signatures on every request. Never skip verification, even in development.
  • Handle duplicate deliveries. Use the X-MemberPad-Delivery header (unique per delivery) to deduplicate if a retry succeeds after a timeout.
  • Subscribe only to events you need. This reduces noise and unnecessary traffic to your endpoint.
  • Monitor the delivery log. Check the Webhooks tab in Admin → Developer API for failed deliveries and error details.
  • Use HTTPS only. MemberPad rejects non-HTTPS webhook URLs.
  • Keep your signing secret secure. Store it in environment variables or a secrets manager, never in source code.

Event Types

22 event types across 6 categories. Subscribe to all events or select specific ones when creating a webhook.

EventDescription
Membership
member.joinedA new member joined the community
member.leftA member left or was removed from the community
member.role_changedA member's role was changed (e.g., promoted to Admin)
Subscriptions
subscription.createdA new subscription was started
subscription.cancelledA subscription was cancelled
subscription.renewedA subscription was successfully renewed
subscription.plan_changedA member upgraded or downgraded their plan
Payments
payment.succeededA payment was successfully processed
payment.failedA payment attempt failed
payment.refund_issuedA refund was issued
Content
post.publishedA new post was published
post.updatedAn existing post was updated
course.publishedA new course was published
course.lesson_completedA member completed a course lesson
course.completedA member completed an entire course
event.createdA new event was created
event.updatedAn event was updated
Commerce
product.purchasedA digital product was purchased
Engagement
comment.createdA new comment was posted on a post
chat.message_postedA message was posted in a chat room
Support
support_ticket.createdA new support ticket was submitted
feature_request.createdA new feature request was submitted