Connect a webhook

Use a webhook when another system should receive finished articles and no built-in destination fits the workflow.

Connect a webhook

You need a public HTTPS endpoint. You can also add a shared secret for signed requests.

1. Open Integrations.
2. Click Add on Webhook.
3. Enter Integration Name, Webhook URL, and an optional Secret.
4. Click Save.

Request format

Kitful sends a POST request with Content-Type: application/json.

{
  "id": "01EXAMPLEARTICLE",
  "title": "How to plan a CRM migration",
  "slug": "plan-a-crm-migration",
  "html": "<h2>Plan the migration</h2><p>...</p>",
  "excerpt": "A practical migration plan for growing teams.",
  "metaTitle": "How to Plan a CRM Migration",
  "metaDescription": "Prepare data, people, and timing for a safer CRM move.",
  "featuredImage": {
    "url": "https://cdn.example.com/crm-migration.webp",
    "alt": "CRM migration planning board"
  },
  "tags": ["crm", "operations"],
  "publishedAt": "2026-07-20T09:00:00.000Z"
}

Fields that are not set can be empty or null. Treat the article ID as an opaque identifier.

Verify a signed request

When a secret is set, each request includes:

X-Kitful-Signature: sha256={hex_signature}

The value is an HMAC-SHA256 signature of the raw JSON body using your secret.

import crypto from 'node:crypto';

function isValidKitfulRequest(rawBody, secret, signature) {
  const digest = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return signature === `sha256=${digest}`;
}

Verify the signature before parsing or acting on the payload. Compare signatures in constant time when your runtime provides that option.

Publish through the webhook

Choose the webhook from an article's Publish dialog, a scheduled slot, or campaign settings. The receiving endpoint must return a successful status only after it accepts the article.

Troubleshoot webhooks

• For 401 or 403 responses, check the receiving service's authentication and shared secret.
• For a 404 response, check the exact endpoint path.
• For another non-success response, inspect the receiving service logs, fix the endpoint, and publish again.