Webhooks

Webhooks send a signed HTTPS request to your own URL when something happens in Atchr — a new conversation, a visitor message, a bot lead, a handover, or a rating. Use them to update a spreadsheet, a CRM, Zapier, Make, or any system you already run.

Plan: Webhooks require an active Professional or Enterprise subscription. Open your entity in the dashboard, then use the Webhooks card on the entity details page.
Webhooks card on entity details

Step 1: Create an HTTPS endpoint

Your server (or a Zapier Catch Hook) must accept POST with a JSON body and respond with HTTP 2xx. Only https:// URLs are allowed in production.

Step 2: Add the webhook in Atchr

  1. Open the dashboard and select the entity that owns the widget.
  2. On entity details, find Webhooks.
  3. Paste your endpoint URL. Optionally add a short description.
  4. Choose the events you care about. Leave unused events unchecked so you do not flood your endpoint.
  5. Click Add webhook.
Create webhook form with events

Step 3: Copy the signing secret

Atchr shows the signing secret once when the webhook is created. Store it with your endpoint. After you leave the page, the dashboard only shows a masked value.

One-time webhook signing secret

Step 4: Send a test

Click Test on the webhook row. Atchr posts a webhook.test event. Use Recent deliveries to see HTTP status codes and errors.

Recent webhook deliveries

Events

Event When it fires
conversation.started A new website or WhatsApp room is created. Reopening an existing room does not fire this.
message.received A visitor (or WhatsApp contact) sends a message. Operator replies do not fire this.
lead.captured A bot form is submitted.
visitor.identified The widget visitor provides a name and email.
bot.handover Adam hands the conversation to a human.
rating.submitted The visitor rates the conversation.

You can have up to five webhooks per entity, including Zapier subscriptions.

Payload

Every delivery is a JSON object:

{
  "id": "deliveryId",
  "event": "lead.captured",
  "created_at": "2026-09-10T17:00:00.000Z",
  "entity": { "id": "entityId", "name": "Acme" },
  "data": {}
}

Use id to ignore duplicate deliveries.

How to verify the signature

Each request includes:

  • X-Atchr-Event — event name
  • X-Atchr-Delivery — delivery id
  • X-Atchr-Timestamp — Unix seconds
  • X-Atchr-Signature — sha256= plus a hex HMAC

Compute HMAC-SHA256 of timestamp + "." + raw JSON body with your signing secret. Compare it to the hex after sha256=. Reject timestamps older than about five minutes.

Retries

Failed deliveries retry up to five times (about 1, 2, 4, 8, then 16 minutes later). Delivery history is kept for 14 days.

Prefer a no-code workflow? See Zapier or post operator alerts with Slack.