Webhooks

POST https://your-endpoint.example.com
Content-Type: application/json
X-ClientInvite-Event: connection.completed
X-ClientInvite-Delivery: 3f9a1c2e-7b4d-4e8a-9c61-0d2b5e8f4a17
X-ClientInvite-Signature: sha256=5d41402abc4b2a76b9719d911017c592...

{
  "event": "connection.completed",
  "apiVersion": 1,
  "timestamp": "2026-07-13T09:41:27.000Z",
  "status": "SUCCESS",
  "accessLevel": "admin",
  "requestId": "5b0f3c8e-2d1a-4c7e-9a61-3f2e8d4b7c10",
  "requestName": "Onboarding - Meta & Google",
  "requestUrl": "https://app.clientinvite.com/workspace/acme-agency/onboarding",
  "clientId": "9c2d7f14-6b3e-4a8f-b1d2-7e5c0a9f3b21",
  "clientName": "Acme Co",
  "clientEmail": "hello@acme.com",
  "clientSummaryUrl": "https://app.clientinvite.com/clients",
  "customRef": "crm-record-8841",
  "connectionSummaryText": "Acme Co granted Admin access to: Meta ads (Acme Co), Facebook page (Acme Co), Google ads (acme.com).",
  "connectionSummaryHtml": "<b>Acme Co</b> granted <b>Admin</b> access to:<br>• Meta ads (Acme Co)<br>• Facebook page (Acme Co)<br>• Google ads (acme.com)",
  "assetCount": 3,
  "connectionAssets": [
    {
      "id": "act_1086344871362999",
      "name": "Acme Co",
      "type": "Meta ads",
      "platform": "Meta",
      "connectionStatus": "Connected",
      "accessLevel": "admin",
      "time": "2026-07-13T09:40:51.000Z",
      "linkToAsset": null
    },
    {
      "id": "104217693118841",
      "name": "Acme Co",
      "type": "Facebook page",
      "platform": "Meta",
      "connectionStatus": "Connected",
      "accessLevel": "admin",
      "time": "2026-07-13T09:40:12.000Z",
      "linkToAsset": null
    },
    {
      "id": "7342018841",
      "name": "acme.com",
      "type": "Google ads",
      "platform": "Google",
      "connectionStatus": "Connected",
      "accessLevel": "admin",
      "time": "2026-07-13T09:41:25.000Z",
      "linkToAsset": null
    }
  ]
}

const crypto = require('crypto');
const express = require('express');
const app = express();

// IMPORTANT: use express.raw() so you hash the raw body, not parsed JSON
app.post(
  '/webhooks/clientinvite',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-clientinvite-signature'] || '';
    const expected =
      'sha256=' +
      crypto
        .createHmac('sha256', process.env.CLIENTINVITE_WEBHOOK_SECRET) // whsec_xxxxxxxxxxxx
        .update(req.body) // raw Buffer
        .digest('hex');

    const valid =
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

    if (!valid) return res.status(401).send('Invalid signature');

    const event = JSON.parse(req.body);
    console.log(event.connectionSummaryText);
    // e.g. post to Slack, update your CRM, etc.

    res.sendStatus(200);
  }
);

app.listen(3000);

import hashlib
import hmac
import json
import os

from flask import Flask, request, abort

app = Flask(__name__)


@app.post("/webhooks/clientinvite")
def clientinvite_webhook():
    # IMPORTANT: hash request.get_data() (the raw body), not request.json
    raw_body = request.get_data()
    signature = request.headers.get("X-ClientInvite-Signature", "")

    expected = "sha256=" + hmac.new(
        os.environ["CLIENTINVITE_WEBHOOK_SECRET"].encode(),  # whsec_xxxxxxxxxxxx
        raw_body,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        abort(401)

    event = json.loads(raw_body)
    print(event["connectionSummaryText"])
    # e.g. post to Slack, update your CRM, etc.

    return "", 200

<?php
// IMPORTANT: hash the raw body from php://input, not $_POST or decoded JSON
$rawBody   = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_CLIENTINVITE_SIGNATURE'] ?? '';

$expected = 'sha256=' . hash_hmac(
    'sha256',
    $rawBody,
    getenv('CLIENTINVITE_WEBHOOK_SECRET') // whsec_xxxxxxxxxxxx
);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
error_log($event['connectionSummaryText']);
// e.g. post to Slack, update your CRM, etc.

http_response_code(200);