Webhooks

Setting up

Add a webhook in Settings → Developers: choose a URL, pick events, and copy the signing secret (shown once). Deliveries are retried a couple of times on failure, then dropped - design your receiver to be idempotent.

Events

Event	Fires when
conversation.created	A new conversation opens in any channel - chat, email, WhatsApp, SMS, Messenger, Teams or video.
message.created	A visitor or agent message lands in a conversation.

Payload

Deliveries are JSON POSTs shaped as { "event": …, "data": … } with two headers:

POST https://your-endpoint.example.com/buzzchat
X-Buzzchat-Event: message.created
X-Buzzchat-Signature: 3f1c64…   ← HMAC-SHA256 of the raw body

{
  "event": "message.created",
  "data": {
    "conversation": "9b2f3a64-…",
    "channel": "chat",
    "author_type": "visitor",
    "body": "Hi! Quick question…"
  }
}

Verifying signatures

Compute the HMAC of the raw request body with your signing secret and compare in constant time:

// PHP
$expected = hash_hmac('sha256', $request->getContent(), $secret);
abort_unless(hash_equals($expected, $request->header('X-Buzzchat-Signature')), 401);

// Node
const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) throw 401;

Always verify against the raw bytes - re-serialising the JSON first will change them and break the MAC.

REST hooks

Building a Zapier/Make-style integration? Subscriptions can also be managed programmatically via the API's hooks endpoints.