Webhooks overview
Model B — receive related Eventyvo data at your HTTPS endpoint with HMAC verification.
Webhooks are the core of Model B: Eventyvo pushes related data already stored in Eventyvo (registrations, payments, check-ins, …) to your server — without putting API keys on your public website.
Configure webhooks on the Developer portal (docs.eventyvo.com) — create URL, select events, copy the signing secret, test delivery. Eventyvo POSTs signed JSON to your HTTPS endpoint.
If you only need features on the site and will keep ops in Eventyvo, use Model A embeds / subwebsite and skip webhooks.
Headers
| Header | Purpose |
|---|---|
X-Eventyvo-Event | Event type (canonical UPPER_SNAKE — catalog) |
X-Eventyvo-Signature | HMAC-SHA256 hex digest |
X-Eventyvo-Timestamp | Unix timestamp (seconds) |
Security
Verify every request — Verification. Never trust unverified payloads. Example bodies: Payloads.
Setup checklist
- HTTPS endpoint that accepts POST
- Create the webhook on /developer and store the secret (server env only)
- Select only the events you need
- Verify signature + timestamp, then enqueue work
- Respond
2xxwithin a few seconds - Use Test on the developer portal to validate delivery
vs Connect REST
| Webhooks | REST polling |
|---|---|
| Push, real-time | Pull, scheduled |
| Best for registrations, payments, check-ins | Best for Zapier/Make exports |
Connect REST requires X-API-KEY on your server — never in the browser.