Webhooks

Webhooks send HTTP POST requests to your server when events happen in VULK — project created, deploy completed, generation finished, and more.

Setting Up Webhooks

1. Go to Settings > Webhooks at vulk.dev/settings/webhooks
2. Click Create Webhook
3. Enter your endpoint URL (must be HTTPS)
4. Select the events you want to receive
5. Click Create

You can have up to 10 webhooks per account.

Events

Project Events

Generation Events

Deploy Events

Export Events

Webhook Payload

Every webhook delivery includes:

{
  "event": "project.created",
  "timestamp": "2026-04-02T15:30:00Z",
  "data": {
    "projectId": "abc123",
    "name": "My App",
    "userId": "user_xyz"
  }
}

Signature Verification

Each webhook request includes a signature header for verification:

X-Vulk-Signature: sha256=abc123...

Verify this by computing HMAC-SHA256 of the request body using your webhook secret:

const crypto = require('crypto');

function verifyWebhook(body, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(body)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

Your webhook secret is shown when you create the webhook. Store it securely.

Delivery Logs

Every webhook delivery is logged with:

• HTTP status code of your endpoint's response
• Response time
• Request/response headers
• Whether delivery succeeded or failed

View delivery logs in Settings > Webhooks by clicking on a webhook.

Test Deliveries

Click Test on any webhook to send a sample payload to your endpoint. This helps verify your integration before real events occur.

Retry Policy

Failed deliveries (non-2xx responses) are retried up to 3 times with exponential backoff.

Troubleshooting

Not receiving webhooks

• Verify your endpoint URL is correct and returns a 2xx status
• Check that HTTPS is configured correctly
• Review delivery logs for error details

Signature mismatch

• Ensure you are using the raw request body (not parsed JSON) for HMAC computation
• Verify you are using the correct webhook secret