Webhooks
Receive publishing and Inbox events on your server, Zapier, Make or n8n, and verify their HMAC signature.
A webhook sends a signed JSON POST request to the URL of your choice for every
event: post published, failure, new message… Webhooks are managed in
Réglages › Webhooks (Settings › Webhooks), in the Développeurs (Developers)
section, reserved for Super admins. Up to 20 webhooks per workspace.
Create a webhook
Click Ajouter un webhook (Add a webhook).
Enter a Nom (Name), such as "Zapier", "Slack" or "CRM", and the receiving URL (https).
Check the Événements (Events) to receive and, if needed, limit to one Marque (Brand); otherwise Toutes les marques (All brands).
Save, then click Envoyer un test (Send a test): Klickbee sends a signed sample
with "test": true and shows the response code.
Events
| Event | Label | When |
|---|---|---|
post.published | Post publié (Post published) | A post is live. |
post.failed | Échec de publication (Publishing failed) | A post has permanently failed (after the automatic retries). |
post.scheduled | Post planifié (Post scheduled) | A post is scheduled, or a new retry is scheduled. |
post.removed | Post supprimé du réseau (Post removed from network) | A post was removed from the network from Klickbee. |
message.received | Message privé reçu (Inbox) (Direct message received) | A new direct message arrives in the Inbox. |
comment.received | Commentaire reçu (Inbox) (Comment received) | A new comment arrives in the Inbox. |
post.published and post.failed are checked by default.
The request sent
Headers:
Content-Type: application/json
User-Agent: Klickbee-Webhooks/1.0
X-Klickbee-Event: post.published
X-Klickbee-Signature: sha256=5d41402abc4b2a76b9719d911017c592…Body for a post event:
{
"event": "post.published",
"timestamp": "2026-10-12T09:00:03.120Z",
"post": {
"id": "…",
"platform": "LINKEDIN",
"status": "PUBLISHED",
"body": "Our new guide is live.",
"scheduledAt": "2026-10-12T09:00:00.000Z",
"publishedAt": "2026-10-12T09:00:03.000Z",
"permalink": "https://www.linkedin.com/feed/update/…",
"errorMessage": null,
"brandId": "…",
"contentId": "…"
}
}message.received contains a message object (conversation, network, account,
sender, text, attachments, date) and comment.received a comment object
(author, text, related post and its link, parent comment if any).
Verify the signature
Each webhook has a signing secret (whsec_…), visible with Secret.
The X-Klickbee-Signature header is sha256= followed by the HMAC-SHA256 of the
request's raw body, in hexadecimal, computed with this secret. Recompute it
before trusting the content:
import crypto from 'node:crypto';
function isValid(rawBody, signatureHeader, secret) {
const expected =
'sha256=' + crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
const a = Buffer.from(expected);
const b = Buffer.from(signatureHeader ?? '');
return a.length === b.length && crypto.timingSafeEqual(a, b);
}Compute the signature on the body as received, before JSON.parse. Keep the
secret server-side. Régénérer le secret (Regenerate secret) invalidates the old
one immediately: update your receiver right away.
Delivery rules
https://URLs only; private or local addresses are rejected.- Your server must respond in under 5 seconds; redirects aren't followed.
- Each event is sent only once, with no retry if your server doesn't respond. The list shows the result of the last delivery (HTTP 200 · …, Injoignable (Unreachable)…).
Uncheck Actif (Active) to pause a webhook without deleting it.