What Webhooks Do
Open Tools → Webhooks. Each endpoint receives the events it subscribes to, filtered by campaign or affiliate if you like, and signed with its own secret. You can add up to 20 endpoints.
To send data to HubSpot, Salesforce, Zapier or Make without code, see CRM & Zapier.
Events
| Event | Sent when | Arrives |
|---|---|---|
conversion.created | A conversion is recorded — any status, including pending and rejected. | Within about a minute |
conversion.status_changed | A conversion is approved, rejected or otherwise changed by your team, the API or an advertiser. | Within about a minute |
cap.reached | A campaign or affiliate hits a click or conversion cap — once per cap per period. | Within about a minute |
affiliate.signup | An affiliate signs up, is added by your team or is imported. | Instantly |
affiliate.status_changed | An affiliate is approved, rejected, suspended or reactivated. | Instantly |
A new endpoint starts with events from the moment it is created; past events are not replayed. Imported conversion history is never sent.
Adding an Endpoint
Click Add webhook
Start from a template (Conversions to my system, New affiliates to my CRM, Cap alerts) or from scratch.
Enter the endpoint URL
It must be HTTPS and reachable from the internet. You can add custom headers, for example an API key your receiver expects.
Choose events and optional filters
Limit to certain campaigns (conversion and cap events) or affiliates. Leave filters empty to send everything.
Copy the signing secret and send a test
Put the secret in your receiver, then use Send test event. Test messages carry sample data and have "test": true.
If the secret leaks, rotate it from Edit. The old secret stops working immediately, so update your receiver straight away.
Message Format
Every message has the same envelope; the event-specific fields are in data.
{
"id": "5d1c0e0a-7f8e-4a7b-9d55-3e2f8f1b6c21",
"event": "conversion.created",
"created_at": "2026-10-19T08:15:02Z",
"account_id": 10001,
"webhook_id": 14,
"test": false,
"data": { … }
}Money values are numbers in the currency named next to them. Times are UTC in ISO 8601. The full field reference for each event is in the Developer guide tab on the Webhooks page.
Verifying the Signature
Each request carries these headers:
| Header | Meaning |
|---|---|
X-Affclix-Event | Event name, for example conversion.created |
X-Affclix-Delivery | Unique delivery ID — the same as the envelope id |
X-Affclix-Attempt | 1 for the first try, 2 or more for retries |
X-Affclix-Signature | t=<unix time>,v1=<signature> |
To verify, compute HMAC-SHA256 of the timestamp, a dot and the raw request body, using your signing secret, and compare it with v1. Reject requests whose timestamp is more than five minutes old.
$body = file_get_contents('php://input');
parse_str(str_replace(',', '&', $_SERVER['HTTP_X_AFFCLIX_SIGNATURE']), $sig);
$expected = hash_hmac('sha256', $sig['t'] . '.' . $body, $secret);
if (! hash_equals($expected, $sig['v1']) || abs(time() - (int) $sig['t']) > 300) {
http_response_code(400);
exit;
}Delivery and Retries
- Answer with any 2xx status within 10 seconds. Do slow work after you respond.
- Anything else is retried 6 more times: after 1 minute, 5 minutes, 30 minutes, 2 hours, 8 hours and 24 hours.
- Redirects are not followed — use the final URL.
- Events can arrive more than once or out of order. Use the id to ignore duplicates.
- If every delivery fails for 72 hours, the endpoint is turned off and the account owner gets an e-mail.
Delivery Log
The Delivery log tab lists every event sent, what your endpoint answered and any retries, searchable by conversion or affiliate ID. Successful deliveries are kept for 14 days and failed ones for 30. Click Resend on a single delivery, or Resend failed deliveries on an endpoint after you fix your receiver.
Managing webhooks needs the Outbound webhooks permission (Integrations › Developer).