How webhooks work

1. Create a webhook subscription via the API specifying the event and your endpoint URL.
2. When the event fires, ForumSpark sends a POST request to your URL with a JSON payload.
3. Each request includes a Signature header: an HMAC-SHA256 hash of the payload signed with your webhook secret.
4. Verify the signature to ensure the request is authentic.

Verifying signatures

$payload    = file_get_contents('php://input');
$signature  = $_SERVER['HTTP_SIGNATURE'] ?? '';
$secret     = 'your_webhook_secret';

$expected   = hash_hmac('sha256', $payload, $secret);

if (! hash_equals($expected, $signature)) {
    http_response_code(403);
    exit('Invalid signature');
}

Available events