> ## Documentation Index
> Fetch the complete documentation index at: https://prakan-saengjan-ep18.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Send real-time events with Webhooks

> Configure webhooks to push real-time project events to your own endpoints. Verify signatures and inspect JSON payloads for secure automation.

Webhooks push real-time event data from your workspace to any HTTPS endpoint you control. Use them to trigger custom automations, log activity, or sync with internal systems. Every webhook event includes a signed payload so you can verify it came from the platform.

## Create a webhook

<Steps>
  <Step title="Open Webhooks settings">
    Go to **Settings > Integrations > Webhooks**.
  </Step>

  <Step title="Add an endpoint">
    Click **New webhook**, then enter your HTTPS endpoint URL.
  </Step>

  <Step title="Select event types">
    Choose the events you want to receive, such as `project.created`, `task.updated`, or `member.invited`.
  </Step>

  <Step title="Save and copy the secret">
    Click **Create**. Copy the signing secret shown once. You will need it to verify payloads.
  </Step>
</Steps>

## Event payload

Each webhook is delivered as a POST request with a JSON body. Here is an example for a task update:

```json theme={null}
{
  "event": "task.updated",
  "timestamp": "2025-01-15T09:23:11Z",
  "data": {
    "task_id": "tsk_8f2a9c1e",
    "project_id": "prj_4b7d3f01",
    "title": "Q1 roadmap review",
    "status": "in_progress",
    "assignee": "user_9e3b2a11",
    "updated_at": "2025-01-15T09:23:11Z"
  }
}
```

## Verify signatures

Every request includes an `X-Webhook-Signature` header generated with HMAC-SHA256 and your signing secret. Verify it before processing the payload.

```python theme={null}
import hmac
import hashlib

def verify_signature(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(f"sha256={expected}", signature)
```

<Warning>
  Always verify the signature before trusting webhook data. If verification fails, return HTTP 400 and do not process the event.
</Warning>

## Next steps

* [Connect a third-party integration](/integrations/connect)
* [Browse all supported integrations](/integrations/overview)