Skip to main content
Publishing is synchronous — POST /v1/posts already tells you what happened, so you do not need a webhook to learn the result of a call you made. Webhooks are for the outcomes nobody is holding a request open for: a scheduled post that failed at 03:00, or an account whose token expired between one post and the next.

​
Add an endpoint

1

Open Webhooks

Select Webhooks in the sidebar, then Add endpoint.
2

Enter your URL

It must be absolute and use https — for example https://example.com/nylon/webhooks. A localhost URL is accepted for local development.
3

Describe it (optional)

A short description shows under the URL in the list. Useful once you have one endpoint per environment.
4

Choose events

Every event is selected by default. See Webhook events for what each one means.
5

Copy the signing secret

On save, Nylon shows the signing secret once: “Copy this now and store it with your other secrets. Nylon cannot show it again — if you lose it, rotate to get a new one.” Put it in your secret manager before closing the dialog.
Nylon Webhooks page showing an Endpoints table with columns for Endpoint, Events, Status, Secret and Last delivery, and an Add endpoint button

The Webhooks page, listing endpoints with their events, status and last delivery.

​
Leaving every event selected

Selecting all of them is not the same as selecting all of them today. Nylon stores “all events” as an empty filter, so an endpoint with everything ticked also receives event types added in future. An endpoint with a specific subset keeps receiving exactly that subset. If you want new event types to reach you automatically, leave all boxes ticked. If your receiver would break on an event it does not recognise, choose explicitly.

​
Verify the signature

Every delivery carries a Nylon-Signature header of the form t=<unix timestamp>,v1=<hex>. The signature is an HMAC-SHA256 over "<timestamp>.<raw body>" using your signing secret. This is deliberately the same scheme Stripe uses, so if you have written this verification once before, it transfers with the variable names changed. Three things matter:
  1. Sign the raw body, before any JSON parsing or re-serialisation. A re-encoded body will not match.
  2. Check the timestamp against a tolerance — 5 minutes is the default Nylon documents. Without this, a captured delivery can be replayed later.
  3. Compare in constant time. A plain === leaks the signature a byte at a time to anyone who can measure your response.

Verifying the signature

Worked verification code, and the full payload shape.

​
Test it before you rely on it

Open the ⋯ menu on the endpoint row and select Send test event. Nylon delivers a real, signed event and reports what came back — the HTTP status if the endpoint accepted it, or the error if it did not. This proves the URL is reachable, that your signature check passes, and that you return a 2xx, before anything real depends on it.

Webhook events

The six events and what each one is for.

Deliveries and failures

Retries, disabled endpoints and rotating the secret.