Webhooks send changes to your application without polling.

Set up an endpoint

Open Webhooks → New endpoint in the dashboard. Enter your HTTPS URL, choose the event types you need and save the signing secret as EVENTLAYER_WEBHOOK_SECRET on your server.

Verify an incoming event

import { verifyWebhook } from "eventlayer";

const event = await verifyWebhook({
  body: await request.text(),
  headers: request.headers,
  secret: process.env.EVENTLAYER_WEBHOOK_SECRET!,
});

if (event.event_type === "ticket.checked_in") {
  console.log(event.data.id);
}

Use the raw request body. The SDK verifies the signature and timestamp before returning a typed event. For a complete handler, follow React to ticket changes.

Event types

Event	Triggered when
`event.created`	A new event is created.
`event.updated`	An event is updated.
`event.deleted`	An event is deleted.
`attendee.created`	A new attendee is added to an event.
`attendee.updated`	An attendee is updated.
`attendee.deleted`	An attendee is removed.
`ticket_type.created`	A new ticket type is created.
`ticket_type.updated`	A ticket type is updated.
`ticket_type.deleted`	A ticket type is deleted.
`ticket.created`	A new ticket is issued.
`ticket.updated`	A ticket is updated.
`ticket.deleted`	A ticket is deleted.
`ticket.assigned`	A ticket is assigned to an attendee.
`ticket.checked_in`	An attendee checks in.

Payload

Each event contains id, event_type, timestamp, attempt and data. The data contains the affected resource; deletion events contain only its ID.

Store the verified event.id with your processing result. Skip events you have already processed so retries and manual replays do not repeat side effects. Return 2xx after durably accepting the event. Delivery order is not guaranteed.

Automatic retries keep the same event and delivery IDs. A manual replay creates a new delivery ID but keeps the original event ID and resource payload. Webhook-Delivery-Id identifies a delivery, not a unique business change.

Retry behavior

Network failures, timeouts, rate limits, and server errors are retried with backoff. Redirects and most other client errors are treated as permanent failures. Retryable HTTP responses are 408, 425, 429, and 5xx. Retries are scheduled after 5 seconds, 5 minutes, 30 minutes, 2 hours, 5 hours, and 10 hours, for up to seven attempts in total. Worker availability may delay an attempt beyond its scheduled time. After the retry schedule is exhausted, the delivery is marked failed.

Inspect failures and replay

Open Webhooks → Delivery log in the dashboard to see attempts, HTTP responses and the next retry time. Select a delivery to investigate it, then use Retry or Resend after fixing the cause. Replays use the endpoint’s current URL.

Signature details

For consumers without the SDK, verify HMAC-SHA256 over Webhook-Timestamp + "." + raw_request_body using your endpoint signing secret. Compare against v1 values in Webhook-Signature in constant time and reject timestamps more than five minutes from the current time.

Secret rotation has a 24-hour overlap. During it, the header can contain multiple signatures; accept one that matches a trusted secret. Manage endpoints and rotate secrets in the dashboard.

Webhooks