Webhooks

Webhooks send a signed HTTPS request to your own URL when something happens in Atchr — a new conversation, a visitor message, a bot lead, a handover, or a rating. Use them to update a spreadsheet, a CRM, Zapier, Make, or any system you already run.

Plan: Webhooks require an active Professional or Enterprise subscription. Open your entity in the dashboard, then use the Webhooks card on the entity details page.
Webhooks card on entity details

Step 1: Create an HTTPS endpoint

Your server (or a Zapier Catch Hook) must accept POST with a JSON body and respond with HTTP 2xx. Only https:// URLs are allowed in production.

Step 2: Add the webhook in Atchr

  1. Open the dashboard and select the entity that owns the widget.
  2. On entity details, find Webhooks.
  3. Paste your endpoint URL. Optionally add a short description.
  4. Choose the events you care about. Leave unused events unchecked so you do not flood your endpoint.
  5. Click Add webhook.
Create webhook form with events

Step 3: Copy the signing secret

Atchr shows the signing secret once when the webhook is created. Store it with your endpoint. After you leave the page, the dashboard only shows a masked value.

One-time webhook signing secret

Step 4: Send a test

Click Test on the webhook row. Atchr posts a webhook.test event. Use Recent deliveries to see HTTP status codes and errors.

Recent webhook deliveries

Events

Event When it fires
conversation.started A new website or WhatsApp room is created. Reopening an existing room does not fire this.
message.received A visitor (or WhatsApp contact) sends a message. Operator replies do not fire this.
lead.captured A bot form is submitted.
visitor.identified The widget visitor provides a name and email.
bot.handover Adam hands the conversation to a human.
rating.submitted The visitor rates the conversation.

You can have up to five webhooks per entity, including Zapier subscriptions.

Payload

Every delivery is a JSON object:

{
  "id": "deliveryId",
  "event": "lead.captured",
  "created_at": "2026-09-10T17:00:00.000Z",
  "entity": { "id": "entityId", "name": "Acme" },
  "data": {}
}

Use id to ignore duplicate deliveries.

How to verify the signature

Each request includes:

  • X-Atchr-Event — event name
  • X-Atchr-Delivery — delivery id
  • X-Atchr-Timestamp — Unix seconds
  • X-Atchr-Signature — sha256= plus a hex HMAC

Compute HMAC-SHA256 of timestamp + "." + raw JSON body with your signing secret. Compare it to the hex after sha256=. Reject timestamps older than about five minutes.

Retries

Failed deliveries retry up to five times (about 1, 2, 4, 8, then 16 minutes later). After that, or while a delivery is still marked failed, use Re-send on Recent deliveries. The same delivery id is reused so receivers can dedupe. Delivery history is kept for 14 days.

Prefer a no-code workflow? See Zapier or post operator alerts with Slack.