Webhooks: get notified when posts publish

PostSider sends a webhook when a post is published. The request contains the serialized post object and event headers. Use webhooks to update a CMS, notify a team, or trigger downstream automation. A webhook can subscribe to all channels or selected channels.

Setting up a webhook

Open Settings → Webhooks

In the dashboard, open Settings and select Webhooks.

Enter a public HTTPS endpoint

Click Add Webhook and enter a publicly reachable HTTPS URL. PostSider blocks localhost, private IP ranges, link-local addresses, and non-HTTP protocols. OSS generates the signing secret automatically and shows it once when the webhook is created. Store it securely because it is not shown again.

Save the webhook

Save the endpoint and copy its signing secret. New endpoints with a secret include X-Postsider-Signature, X-Postsider-Timestamp, and X-Webhook-Attempt headers.

Event and payload

OSS v1.0.1 sends the single event post.published after a successful publish. Every delivery includes X-Postsider-Event, X-Postsider-Timestamp (unix seconds), and X-Webhook-Attempt (1-based, 1..3). The signature header is added only when a signing secret is configured. The JSON body is a serialized array of the matching post records - one element per published post:

[
  {
    "id": "post_abc123",
    "content": "...",
    "publishDate": "2026-06-15T10:00:00.000Z",
    "releaseURL": "https://x.com/...",
    "state": "PUBLISHED",
    "integration": { "id": "ch_abc123", "name": "My X", "providerIdentifier": "x" }
  }
]

Verify signatures

Signed requests include X-Postsider-Signature and X-Postsider-Timestamp. The signature is sha256=<hex>, calculated as HMAC-SHA256 of timestamp + "." + rawBody, using the webhook secret. Reject timestamps older than five minutes.

import Postsider from '@postsider/node';

const signature = req.headers['x-postsider-signature'] as string;
const timestamp = req.headers['x-postsider-timestamp'] as string;
const rawBody = req.rawBody.toString('utf8');

const valid = Postsider.verifyWebhookSignature(
  signature,
  rawBody,
  process.env.WEBHOOK_SECRET!,
  timestamp,
);

if (!valid) {
  res.status(401).send('Invalid signature');
  return;
}

res.status(200).send('OK');

If your framework does not expose raw request bytes, preserve the exact JSON body before parsing. Re-serializing parsed JSON can change whitespace or key order and invalidate the signature.

Retry behavior

PostSider retries timeouts, network failures, and server errors (5xx) up to three total attempts. Client errors (4xx) are logged and are not retried:

Attempt	Delay
1st attempt	Immediate
2nd attempt	About 1 second
3rd attempt	About 2 seconds

After three failed attempts the delivery is abandoned. Make your endpoint idempotent and use the post id from the body as a deduplication key.

SSRF protection

PostSider validates webhook URLs when they are saved and again at delivery time. Endpoints must be public HTTPS URLs; plain HTTP, private, loopback, link-local, and internal destinations are rejected, including DNS rebinding to an internal address.

Get Started

Core Concepts

Features

Settings

Channels

Configuration

Security

Resources

Webhooks: get notified when posts publish

Setting up a webhook

Event and payload

Verify signatures

Retry behavior

SSRF protection

​Setting up a webhook

​Event and payload

​Verify signatures

​Retry behavior

​SSRF protection

Setting up a webhook

Event and payload

Verify signatures

Retry behavior

SSRF protection