Connecting an AI is a way to ask SupahPost things. A webhook is the other
direction: you give us an address, and we tell your own systems the moment something
happens — a post publishes, a post fails, a report finishes. People use it to drop a row
in a spreadsheet, page whoever is on call, or kick off the next step of their own
pipeline.
Add one in Settings → Integrations → Webhooks: paste an
https:// address, tick the events you want, and press Add. There is a
Send test button beside it, and a log of the last 50 deliveries with what
your server answered and how long it took.
The events you can subscribe to:
- post.published — a post went live on one account (once per account).
- post.failed — a post did not go out on one account.
- post.scheduled — something entered the queue.
- post.approval_requested — a post is waiting on a person.
- post.approved — an approver released it.
- post.changes_requested — an approver sent it back with a note.
- account.needs_reconnect — a connection stopped working.
- account.rpm_drop — a page's revenue per view fell well below its own normal.
- account.reach_collapse — an account has stopped reaching people, and whether we held its posts.
- report.generated — a report finished building.
The message carries ids, not content. It says what happened —
which post, which account, which platform — and never the caption, the image or anything
else you wrote. That is deliberate: it is going to a server we do not run. Your server
fetches the detail afterwards, over MCP or the API, with a key of its own.
Every request is signed, so you can be sure it came from us. The
X-SupahPost-Signature header looks like
t=1756900931,v1=<hex>, where the hex is an HMAC-SHA256 of
<t>.<raw body> using your signing secret. Refuse anything whose
t is more than five minutes old. Accept the request if any
v1 matches — during a rotation there are two. The exact code to do that is on
the Connect your AI page, under “Other AI tools”.
The signing secret is shown once, when you create the endpoint. We store
it encrypted and cannot show it to you again. If you lose it, press
Rotate: you get a new one and the old one keeps working for 24 hours, so
you can deploy the change without missing anything.
If your server is down we keep trying, with a growing gap, for up to 24 hours. We do not
retry when your server answers with a 4xx — that means the address is wrong, not that it is
busy. After 10 failed deliveries in a row we switch the endpoint off and tell you, in the
app and by email; fix it and switch it back on from the same screen.
We will only post to an address that is reachable on the public internet, over https. A
private or internal address is refused when you add it, and checked again every time we
send.