Webhooks

Configure an HTTPS endpoint in the dashboard (webhook endpoints are dashboard-only, not MCP). Deliveries POST a JSON envelope and sign the raw body with HMAC-SHA256. Verify header X-Bootstrapware-Signature (hex digest) using your endpoint secret.

Webhooks carry operational identifiers only. They do not include post title or body. A failed delivery is retried once. There are no vote webhooks in v1.

Events

Envelope shape

{
  "event": "feedback.post_created",
  "workspaceId": "ws_...",
  "productId": "feedback",
  "timestamp": "2026-08-24T12:00:00.000Z",
  "data": { /* event-specific ids only */ }
}

Verify signature (Node)

Compare the header to HMAC-SHA256 of the exact raw request body (hex). Use a timing-safe compare:

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyBootstrapwareSignature(
  rawBody: string,
  header: string | null,
  secret: string,
) {
  if (!header) return false;
  const expected = createHmac("sha256", secret).update(rawBody).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(header, "hex");
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

Parse JSON only after verification. Do not re-serialize the body before hashing, the signature is over the bytes that were POSTed.

BYO does not emit these

Hosted create and Hosted dashboard status changes emit Bootstrapware Feedback webhooks. BYO adapters keep content on your backend and do not emit Bootstrapware post webhooks for your store. Wire your own notifications from your API if you need them.

Related: post_created · status_changed · Sessions · Webhooks guide · Security