What is a webhook endpoint? The URL that receives events, explained with a real one

Set up a webhook endpoint, step by step

A receiving endpoint from zero, in about ten minutes, with PostWire as the sender. The free plan includes webhooks, so the whole thing costs nothing.

1. Create a free PostWire account and an API key

   Open the dashboard and sign in with your email: a 6-digit code, no password, no card. The free plan is 1 business, 10 posts a month, 2 networks per post, no card, with the REST API, the MCP server and 2 webhook endpoints. Under API & MCP press Create key; the key is sent as Authorization: Bearer.

2. Put a public HTTPS URL in front of your code

   The endpoint must be reachable from the internet over https://: a route on your deployed app (/hooks/postwire in the examples below), a serverless function, or the production URL of an n8n Webhook node or a Make or Zapier custom webhook. A localhost address, a private IP or an http:// URL is refused with bad_url, and redirects are not followed, so give the final URL.

3. Register the endpoint with the sender

   In the dashboard: API & MCP → Webhooks → add the URL. Or one request. The response carries the signing secret once; store it as an environment variable, it is never shown again.

   curl -X POST https://postwire.io/api/webhooks \
     -H "Authorization: Bearer $POSTWIRE_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{
       "url": "https://example.com/hooks/postwire",
       "events": ["post.published", "post.failed", "connection.reauth_required"],
       "description": "Production app"
     }'
   # → 201 { "webhook": { "id": "…", "url": "…", "events": [...] }, "secret": "whsec_…" }

4. Send a test event before anything real

   The sender posts a signed webhook.test event to the URL now and reports what your endpoint answered, so you see the headers and the body without publishing anything.

   curl -X POST https://postwire.io/api/webhooks/<id>/test \
     -H "Authorization: Bearer $POSTWIRE_API_KEY"

5. Verify the signature, then act on the event

   Read the raw body, compute HMAC-SHA256 with your secret over <t>.<raw body>, compare it with v1 in constant time, and reject a t older than 5 minutes. Only then parse the JSON.

   // Node.js (Express)
   import crypto from "node:crypto";
   app.post("/hooks/postwire", express.raw({ type: "application/json" }), (req, res) => {
     const parts = Object.fromEntries(req.get("PostWire-Signature").split(",").map((p) => p.split("=")));
     const want = crypto.createHmac("sha256", process.env.POSTWIRE_WEBHOOK_SECRET)
       .update(`${parts.t}.${req.body}`).digest("hex");
     const a = Buffer.from(want), b = Buffer.from(parts.v1 || "");
     const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
     if (!fresh || a.length !== b.length || !crypto.timingSafeEqual(a, b)) return res.sendStatus(400);
     const event = JSON.parse(req.body);
     // dedupe on req.get("PostWire-Delivery"), then branch on event.type
     res.sendStatus(200);
   });

6. Answer 2xx fast, do the slow work after

   The sender waits 5 seconds for an answer. Reply 200 as soon as the signature checks out and push the real work (a Slack message, a database row, an email to the client) onto a queue. Anything other than a 2xx — a timeout, a 4xx, a 5xx, a redirect — is retried after 1 min, 5 min, 15 min, 1 h, 3 h, 6 h, 12 h and 24 h, with the same PostWire-Delivery id each time, so an endpoint that was down for a night still gets every event.

7. Read the delivery log when something looks off

   Every try is written down with its status, the number of attempts, your endpoint's last answer and the payload, so a missing event is never a mystery.

   curl https://postwire.io/api/webhooks/<id>/deliveries \
     -H "Authorization: Bearer $POSTWIRE_API_KEY"

Using n8n? The PostWire Trigger node of the PostWire n8n node does steps 3 to 6 by itself: it registers the endpoint when the workflow is activated, removes it when it is deactivated and checks the signature of every delivery. See n8n social media automation and the webhooks guide.