BigRadarDocs
Dashboard
Guides›Messaging›Set up incoming message webhooks
Guides

Set up incoming message webhooks

Get replies, delivery receipts and template status changes pushed to your own server instead of only appearing in the BigRadar inbox.

  1. Create an endpoint

    In the dashboard, go to Settings → API & webhooks and add a webhook endpoint pointing at a URL on your server that can accept a POST request.

  2. Save the signing secret

    Each endpoint gets its own whsec_ secret, shown once at creation (and re-viewable from the endpoint's settings). You'll use it to verify requests really came from BigRadar.

  3. Verify the signature

    Every request carries an X-BigRadar-Signature header shaped t=<timestamp>,v1=<hex digest>. Recompute the digest over the raw, unparsed request body and compare:

    Node.js
    json
    const [, t, v1] = signatureHeader.match(/t=(\d+),v1=([0-9a-f]+)/); // Reject anything older than a few minutes — stops a captured request being replayed later. if (Date.now() / 1000 - Number(t) > 300) throw new Error("stale signature"); const expected = crypto .createHmac("sha256", WEBHOOK_SECRET) .update(`${t}.${rawBody}`) .digest("hex"); // Constant-time compare — never a plain ===. if (!crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected))) { throw new Error("signature mismatch"); }

  4. Send a test event

    From the endpoint's settings, use Send test event to fire a sample payload at your URL before any real traffic depends on it.

  5. Reply fast, process after

    Return a 2xx as soon as you've durably stored the event — do the actual processing afterwards. A slow or failing endpoint gets retried up to 4 times over roughly 36 minutes, then disabled if it keeps failing; failed deliveries can be replayed from the dashboard.