Endpoints

An endpoint is the URL on your server that receives webhooks. With Webhooks 2.0 you can have up to 10, and each one receives only the events you select for it.

Create an endpoint

Authentication headers

The token, header name and credentials are values you choose; Tonder stores them and sends them on every request. Verify the signature in every case: an authentication header is an extra layer, not a replacement.

Generate a long random value for each endpoint, and don't reuse your Tonder API key or any other credential. Keep tokens out of the endpoint URL: the URL is shown in the endpoint list.

Manage endpoints

Each endpoint in Developers › Webhooks has an actions menu:

The list shows each endpoint's authentication method, subscribed events, error rate over the last 24 hours and status. Everything on this screen is also available through the Webhooks API.

Troubleshooting

• The endpoint isn't receiving an event: check that it is Active, subscribed to that event, publicly reachable over HTTPS, and answering a 2xx within 10 seconds. Find the event in the Events log to see what your server answered.
• The URL is rejected when you create the endpoint: it isn't https://, or it points to a private or internal address.
• Your server rejects the requests: check that it expects the authentication method and credentials configured on the endpoint, and that it verifies the signature against the current secret.

Accounts without Webhooks 2.0

On the previous version you register one URL through the API, and that URL receives every event.

Register the URL

Register a new URL with the /webhooks/ endpoint. You can configure authentication to secure your endpoint:

curl -X POST https://stage.tonder.io/api/v1/webhooks/ \
  -H "Authorization: Token YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-site.com/webhook-handler",
    "auth_method": "BEARER",
    "credentials": {
      "token": "a-secure-bearer-token-you-generate"
    }
  }'

The response confirms the created endpoint:

{
  "id": 123,
  "url": "https://your-site.com/webhook-handler",
  "status": "active",
  "auth_method": "BEARER",
  "credentials": {
    "token": "a-secure-bearer-token-you-generate"
  }
}

Authentication methods

What your endpoint receives depends on the auth_method you configure:

With API_TOKEN you define both the name of the header and its value, and we send it verbatim, adding no prefix. To receive Authorization: Token abc123, configure header: "Authorization" and token: "Token abc123". A header of your own, such as X-Api-Key, also works.

{
  "url": "https://your-site.com/webhook-handler",
  "auth_method": "API_TOKEN",
  "credentials": {
    "header": "X-Api-Key",
    "token": "a-secret-you-generate"
  }
}

In all cases the secret is generated by you. We store it and resend it on every notification so your backend can validate it.

Manage the URL

curl -X GET https://stage.tonder.io/api/v1/webhooks/ \
  -H "Authorization: Token YOUR_API_KEY"

curl -X PUT https://stage.tonder.io/api/v1/webhooks/123/ \
  -H "Authorization: Token YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://your-updated-site.com/webhook-handler" }'

curl -X DELETE https://stage.tonder.io/api/v1/webhooks/123/ \
  -H "Authorization: Token YOUR_API_KEY"

On the previous version the endpoint must answer a 2xx within 30 seconds, and each event is delivered once — see Without Webhooks 2.0.

Next steps