Webhooks
Real-time event notifications
Get notified the instant a booking is created, rescheduled, cancelled, or completed. HMAC-signed, retried automatically, fully inspectable from the dashboard.
Events
- •
booking.created— new booking - •
booking.rescheduled— time or staff changed - •
booking.cancelled— cancelled by customer or business - •
booking.completed— service rendered - •
payment.succeeded— Stripe charge succeeded - •
payment.refunded— refund issued - •
customer.created— new customer in your tenant
Example payload
POST /your-endpoint HTTP/1.1
Content-Type: application/json
X-BookFlow-Signature: t=1731000000,v1=4f8b2...
X-BookFlow-Event: booking.created
{
"id": "evt_2b3c4d",
"type": "booking.created",
"created": 1731000000,
"data": {
"bookingId": "bk_123",
"serviceName": "Haircut",
"staffName": "Jamie",
"startTime": "2026-08-15T15:00:00Z",
"customer": {
"name": "Maya Chen",
"email": "[email protected]"
}
}
}Signature verification
Every webhook is signed with HMAC-SHA256. Verify theX-BookFlow-Signatureheader to ensure the request came from BookFlow.
const expected = hmacSha256(secret, `${timestamp}.${rawBody}`);
if (!timingSafeEqual(expected, header.v1)) throw new Error("bad signature");Retries
Failed deliveries (non-2xx or timeout) are retried with exponential backoff: 1 min, 5 min, 30 min, 2h, 12h, 24h. After 24h the event is moved to the dead-letter queue and shown in the dashboard.
Full reference
Event catalog, payload schemas, signature verification in 6 languages, local testing with the CLI, replay tool, and dead-letter recovery.
Read the full webhooks guide