How to set up and use SupportKori webhooks
Updated on 21 Jul 2026 · 6 min read
1. What a webhook is
A webhook is a way for SupportKori to tell another app the moment something happens. You give us a URL you control, and every time you make a sale we send that URL a small message with the details — instantly, automatically, no polling.
Think of it as: “whenever I get a sale, knock on this door and tell them.” What the app on the other side does with it is up to you — update a spreadsheet, add a Discord role, bump a counter on your website, log it in your own database.
Webhooks are for developers and power users. If you just want sale alerts on your phone, use the Telegram integration instead — no code needed.
2. Create a webhook
- 1
Go to your Dashboard → Integrations → Webhooks → Create.
- 2
Give it a name, paste your endpoint URL (must be
https://), and pick which events to receive. - 3
Hit Create. We’ll show your signing secret once — copy it and keep it safe (more on that below).
The events you can subscribe to:
| Event | Fires when |
|---|---|
| sale.created | A product is purchased, or claimed for free |
| course.enrolled | A student enrolls in one of your courses |
| support.created | Someone sends you a tip |
3. What we send
Every event is a POST request with this JSON body:
{
"id": "703365aa-8c9e-4a84-...", // unique delivery id
"event": "sale.created",
"creator": "yourusername",
"createdAt": "2026-07-21T05:19:00Z",
"attempt": 1,
"livemode": true, // false for test events
"data": {
"itemTitle": "My Digital Product",
"buyerName": "Rahim",
"amount": 500,
"currency": "BDT",
"orderId": "BwL0yR1W..."
}
}And these headers:
| X-SupportKori-Event | the event name |
| X-SupportKori-Delivery | the unique delivery id |
| X-SupportKori-Signature | sha256=… — proves it’s really from us |
4. Verify the signature
Anyone could POST fake data to your URL. To be sure a request really came from SupportKori, check the signature using your signing secret. It’s an HMAC-SHA256 of the exact raw body:
// Node.js example
import crypto from "crypto";
function verify(rawBody, headerSig, secret) {
const expected = "sha256=" +
crypto.createHmac("sha256", secret)
.update(rawBody)
.digest("hex");
return crypto.timingSafeEqual(
Buffer.from(headerSig), Buffer.from(expected)
);
}Sign the raw request body exactly as received — not a re-serialized version. Even a reordered key breaks the check.
5. Test it in 2 minutes
Don’t have your endpoint ready yet? Use webhook.site — a free page that gives you a URL and shows every request it receives.
- 1
Open webhook.site and copy the unique URL it gives you.
- 2
Create a webhook in SupportKori with that URL.
- 3
Open the webhook’s page → Send test event.
- 4
Switch to the webhook.site tab — the full request appears, body and headers. That confirms your endpoint is reachable before you go live.
Test events carry "livemode": false so your code can tell them apart from real sales. Successes and failures both show up in your webhook’s Event deliveries log.
6. Example: log every sale to a Google Sheet
A live sales ledger with zero manual work — and no coding platform needed, because Google Sheets has its own free scripting tool.
- 1
Open a new Google Sheet → Extensions → Apps Script.
- 2
Delete what’s there and paste this:
function doPost(e) {
const p = JSON.parse(e.postData.contents);
const d = p.data;
SpreadsheetApp.getActiveSheet().appendRow([
p.createdAt,
d.itemTitle,
d.buyerName,
d.amount,
d.currency
]);
return ContentService.createTextOutput("ok");
}- 3
Deploy → New deployment → Web app. Set “Who has access” to Anyone, then Deploy. Copy the web-app URL it gives you.
- 4
In SupportKori, create a webhook with that URL, subscribed to Sale created.
- 5
Hit Send test event — a new row should appear in your sheet. Done.
From now on, every real sale adds a row automatically: date, product, buyer, amount, currency. The same idea works for a Discord bot (grant a role), a Notion database, a Trello board, or your own site’s “X customers” counter.
7. Good to know
Respond quickly with a 2xx
Return any 200-range status as fast as you can. If your endpoint errors or times out, we retry once, then mark that delivery Failed in your log.
Disable without deleting
Flip Delivery status off on a webhook to pause it — handy while you’re fixing your endpoint. No events are sent while it’s off.
Lost your secret?
Open the webhook → ⋯ menu → Regenerate secret. The old one stops working immediately, so update your endpoint with the new value.
https only
Endpoints must be https:// public URLs. Local or private addresses are rejected for security.
Did this article help?