Webhooks

Webhooks tell your own app when something happens in your Feedigy account. Feedigy sends a signed POST request to your HTTPS endpoint for each event.

To send feed posts to Zapier, Make, n8n or another automation tool, use the Automation platforms Auto-Publisher instead.

Events

Event	When Feedigy sends it
post.published	A post was published.
publisher.run.failed	A scheduled Auto-Publisher run failed and will not retry.
channel.token_expired	A connected channel needs reconnecting.

The fields of each event are in the API Reference.

Add an endpoint

1. Open Settings → API → Webhooks.
2. Under New endpoint, enter the Endpoint URL. It must use HTTPS. Private network addresses and URLs with a username, password or #fragment are refused.
3. Optional: enter a Name.
4. Under Events, tick the events you want.
5. Select Create endpoint.
6. Copy the Signing secret. Feedigy shows it once. Your endpoint uses it to check that a request came from Feedigy.

You can have up to 20 endpoints.

What your endpoint receives

POST /your-path
Content-Type: application/json
X-Feedigy-Event: post.published
X-Feedigy-Delivery: 4812
X-Feedigy-Timestamp: 1767225600
X-Feedigy-Signature: t=1767225600,v1=<signature>

{
  "event": "post.published",
  "event_id": "…",
  "version": 1,
  "occurred_at": "2026-01-01T00:00:00Z",
  "data": { "post": { "id": 99, "title": "Hello" }, "feed": { "id": 12, "title": "My feed" } }
}

Return any 2xx status within 10 seconds to accept the delivery.

Check the signature

Check every request before you read its JSON:

1. Take t and every v1 value from X-Feedigy-Signature.
2. Reject the request if t is more than 5 minutes from your current time.
3. Compute HMAC-SHA256 of <t>.<raw request body> with your signing secret, as lowercase hex. Use the exact raw body, not re-encoded JSON.
4. Accept the request if your value matches any v1 value. Use a constant-time compare.

PHP example:

$raw = file_get_contents('php://input');
$timestamp = null;
$signatures = [];
foreach (explode(',', $_SERVER['HTTP_X_FEEDIGY_SIGNATURE'] ?? '') as $part) {
    [$k, $v] = array_pad(explode('=', $part, 2), 2, '');
    if ($k === 't') {
        $timestamp = $v;
    } elseif ($k === 'v1' && $v !== '') {
        $signatures[] = $v;
    }
}
$expected = hash_hmac('sha256', ($timestamp ?? '').'.'.$raw, $secret);
$valid = $timestamp !== null && abs(time() - (int) $timestamp) <= 300;
$valid = $valid && array_filter($signatures, fn ($sig) => hash_equals($expected, $sig)) !== [];
if (! $valid) {
    http_response_code(401);
    exit;
}

Retries and duplicates

• Feedigy tries each delivery up to 5 times: at once, then after about 10 seconds, 1 minute, 5 minutes and 30 minutes. If your endpoint returns 429 or 503 with Retry-After, Feedigy waits that long instead.
• Feedigy does not follow redirects.
• A delivery can arrive more than once, and events can arrive out of order. Store X-Feedigy-Delivery or the event_id, and skip ones you already processed. A retry has the same body and the same delivery id.
• After 5 failed deliveries in a row, Feedigy disables the endpoint and sends you a notification. Select Enable to turn it on again. Deliveries that waited while it was disabled are then sent.

Manage endpoints

In Settings → API → Webhooks, each endpoint shows its failed deliveries in a row, last success and last failure.

• Deliveries: see the delivery log with status codes. Use Failed to see only failures, and Redeliver to send a failed delivery again.
• Disable / Enable: pause and resume deliveries.
• Rotate secret: get a new signing secret. The old secret stays valid for 24 hours. During that time, X-Feedigy-Signature has two v1 values, so accept either.
• Delete: remove the endpoint. Its remaining deliveries are cancelled. You cannot undo this.

What is in a payload

Payloads are small: ids and short summaries, under 64 KB. They never contain tokens, passwords or secrets. To get the full object, call the API with the id. If the payload shape changes in a breaking way, version changes.