Webhooks (Zapier, Make, Slack)

What webhooks do

A webhook turns "something happened in your program" into "any app you like reacts". New referral → a row in a spreadsheet. Affiliate approved → a Slack message. Payout completed → a record in your accounting tool. Anything a Zapier zap, Make scenario, or custom endpoint can do.

Setting up

Go to Affiliates → Settings → Webhooks. You can configure up to three endpoints, each with:

• URL — where to send events. Only https:// endpoints are accepted. For Zapier, create a Catch Hook trigger and paste its URL; for Make, a Custom webhook; for Slack, a workflow webhook.
• Secret — optional but recommended; used to sign every request (see below).
• Events — pick which events this endpoint receives. All boxes checked (or none) means everything.

Available events: referral.created, referral.status_changed, affiliate.registered, affiliate.status_changed, payout.created, payout.status_changed.

The payload

Each event is a JSON POST like:

{
  "event": "referral.created",
  "site": "https://yourstore.com",
  "sent_at": "2026-08-26T14:00:00+00:00",
  "data": {
    "referral_id": 118,
    "affiliate_id": 7,
    "source": "woocommerce",
    "reference": "4021",
    "referral_type": "sale",
    "attribution": "link"
  }
}

Payloads deliberately contain ids and statuses only — never names, emails, or amounts owed to specific people. If your automation needs more, it can fetch details from the REST API using the id.

Verifying signatures

When an endpoint has a secret, every request carries two headers:

• X-AFWP-Event — the event name.
• X-AFWP-Signature — sha256= followed by the HMAC-SHA256 of the raw request body, keyed with your secret.

Recompute the HMAC over the raw body and compare. If they differ, ignore the request — someone other than your store sent it.

Performance & reliability

Webhooks are sent fire-and-forget with a 2-second cap and no waiting for a response, so a slow or dead endpoint can never slow your checkout or admin down. Every dispatch is recorded in the activity log (event name and destination host), so you can always see what was sent where.