Webhooks: get every click as a POST

Have your own server POSTed to every time a link is clicked. Slack / Discord / your CRM / your spreadsheet.

Webhooks are a Pro feature. We POST a small JSON payload to an HTTPS endpoint you control every time a click happens. Pair this with Slack incoming webhooks, Zapier, n8n, your own server, anything that takes an HTTP POST.

Step 1: Register the endpoint

• Settings → Tracking → Webhooks → + New webhook.
• Name: for your reference only ("#growth in Slack").
• URL: the endpoint we'll POST to. Must be HTTPS.
• Secret: optional. If set, we sign the payload with HMAC-SHA256 in the x-bnkl-signature header.
• Save.

Step 2: Subscribe a link to the webhook

• Edit → Tracking tab → toggle the webhook in the list. Multiple webhooks can fire on the same link.
• Save.

The payload we POST

{
  "event": "click",
  "slug": "spring-drop",
  "link_id": "uuid",
  "destination": "https://...",
  "ts": "2026-05-17T12:34:56Z",
  "referer": "https://...",
  "country": "US",
  "region": "California",
  "browser": "Chrome",
  "device": "mobile",
  "is_qr_scan": false
}

Verifying the signature

If you set a secret, the request will carry `x-bnkl-signature: sha256=<hex>`. Compute HMAC-SHA256 over the raw request body using your secret; compare to the header value.

// Node example
const crypto = require("crypto");
const expected = "sha256=" + crypto.createHmac("sha256", secret)
  .update(rawBody).digest("hex");
if (expected !== req.headers["x-bnkl-signature"]) {
  return res.status(403).end();
}

Retry / timeout behaviour

• Each POST has a 1.5-second timeout; we won't keep a visitor's redirect waiting on your endpoint.
• We don't retry. If your endpoint is down, the click is logged in our database but you don't get the POST.
• For higher reliability, point the webhook at a queue (SQS, Inngest, Pipedream) that your real consumer reads from.

Common patterns

• Slack notification: point at a Slack incoming webhook URL. Slack expects { text: "..." }; use a Zap/Pipedream/your own bridge to reshape our payload.
• Sheet logger: point at a Google Apps Script web app or a Zapier zap that appends to a sheet row.
• Internal CRM enrichment: point at your own endpoint to attach the geo + device data to the lead.