Set up webhooks

Register a webhook endpoint in ChronSync to receive signed HTTP POST notifications when bookings, plans, payments, and waitlist entries change.

Receive a notification at your own endpoint whenever something changes in ChronSync — a booking is created, a plan is approved, a payment is refunded. ChronSync delivers each event as a signed HTTP POST so you can react in real time instead of polling the API.

Before you start

You need a public HTTPS endpoint that accepts POST requests.
You need access to Settings for your account.

Register an endpoint

Go to Settings → Webhooks.

[Screenshot: The Webhooks page under Settings, listing existing endpoints]

Add an endpoint URL — the public HTTPS address ChronSync will POST to.

Select the events you want this endpoint to receive.

[Screenshot: The event selector with checkboxes grouped by booking, plan, event_type, payment, and waitlist]

Save the endpoint. Copy its signing secret — you'll use it to verify incoming deliveries.

The endpoint appears in the list and starts receiving the events you selected. ChronSync sends each one as an HTTP POST with the event payload in the body.

Available events

Resource	Events
`booking`	created, cancelled, rescheduled, reassigned
`plan`	proposed, approved, rejected
`event_type`	created, updated, deleted
`payment`	completed, refunded
`waitlist`	joined, offered, converted, expired

Verify the signature

Each delivery is signed so you can confirm it really came from ChronSync. The request carries an HMAC-SHA256 signature in the X-ChronSync-Signature header, alongside headers identifying the event type, delivery ID, and timestamp.

To verify a delivery, compute an HMAC-SHA256 of the raw request body using your endpoint's signing secret, then compare it to the value in X-ChronSync-Signature:

expected = HMAC_SHA256(signing_secret, raw_request_body)
if not constant_time_equals(expected, header["X-ChronSync-Signature"]):
    reject the request (HTTP 400)

Always verify the signature against the raw, unparsed request body, and use a constant-time comparison. Reject any request whose signature doesn't match — it may not be from ChronSync.

Track and redeliver

Every delivery is recorded with its status and the number of attempts made. If an endpoint was down or returned an error, you can redeliver a failed event from the Webhooks page once your endpoint is healthy again.