Webhooks

Receive changes reliably.

React to domain, hosting, DNS, mailbox, and order events without continuously polling status endpoints.

HTTPS endpoint

Register webhook

lxi webhooks create https://app.example/webhooks/lxi \
  --event hosting.active --event dns.updated

The signing secret starts with whsec_ and is shown exactly once. Store it in your secret store.

Event types

Subscribe specifically

domain.created, domain.active, hosting.created, hosting.active, dns.updated, mailbox.created, mailbox.updated, mailbox.deleted, order.created and order.paid. With * you subscribe to all.

HMAC SHA-256

Verify each delivery

Compute HMAC-SHA256 over X-LXI-Timestamp + "." + raw_body and compare in constant time with the hex value from X-LXI-Signature: v1=…. Discard old timestamps and parse JSON only after successful verification.

expected = hmac_sha256(secret, timestamp + "." + raw_body)
constant_time_compare("v1=" + expected, signature)

Repeats

Process idempotently

Respond within 20 seconds with 2xx. Failed deliveries are retried up to eight times with exponential backoff. Store X-LXI-Delivery, so that an event is processed only once.

Test

Send test event

lxi --json webhooks list
lxi webhooks test WEBHOOK_ID