Webhooks Reference
Receive automated real-time JSON payloads at endpoint locations when invoices are created, modified, paid, or deleted.
Overview
Webhooks allow you to coordinate external actions - such as updating status inside your admin dashboards, activating subscriptions, or sending custom receipts. Add endpoints directly under the Organization Settings → Webhooks tab.
Event Types
InvForge broadcasts the following webhook triggers:
| Event Name | Description |
|---|---|
| invoice.created | Dispatched when a new record is saved. |
| invoice.paid | Dispatched when status changes to Paid. |
| invoice.deleted | Dispatched when a record is deleted. |
Signature Verification
Every callback request includes an X-InvForge-Signature header. This is a hexadecimal HMAC-SHA256 signature calculated from the raw payload body and your webhook signing secret.
import { createHmac, timingSafeEqual } from "crypto";
export function verifySignature(rawBody, signatureHeader, secret) {
const hash = createHmac("sha256", secret).update(rawBody).digest("hex");
return timingSafeEqual(Buffer.from(signatureHeader, "hex"), Buffer.from(hash, "hex"));
}Retry Policies
If your server returns anything outside the 2xx success range, the callback is automatically placed into a retry queue. Retries run up to 5 times at increasing intervals (1m, 5m, 30m, 2h, 12h).