HoneyGate Docs
Pricing Add to Discord

Outbound webhooks

Get a signed HTTP POST to your own endpoint the moment something happens in your server.

Webhooks are the push counterpart to the REST API. Instead of you polling HoneyGate, HoneyGate calls your URL the instant something happens. Available on every plan.

Setup

In the admin panel under Webhooks (/admin/outbound-webhooks/), add a subscription with:

Each subscription gets its own signing secret. You can run up to 10 active subscriptions per server.

Events you can subscribe to

The full set of events:

Subscribe to * to receive everything.

A note on the gate events. gate.passed and gate.failed tell you when somebody's status changed — they started passing a gate, or they stopped. They are not a heartbeat. We re-check every member against every gate every few minutes, but a member who passed last check and still passes this one hasn't done anything, so no event is sent. You'll hear from us the first time we ever evaluate somebody, and after that only when the answer flips.

That means you can treat each one as a real "this person just qualified" / "this person just lost access" signal, and act on it directly. If what you want instead is "who currently qualifies?", ask for their status rather than counting webhook traffic — the absence of an event means nothing changed, not that something is wrong.

A note on the wallet events. Somebody links a wallet to their Discord account once, and it then counts in every server they're in — it isn't linked "to" one server. So when it happens, each of your servers that they belong to gets its own copy of the event, carrying that server's guild_id. You'll only ever hear about people who are in your server, and only while they still are.

These two are the moment to react if you gate anything on wallet ownership — they fire as soon as the link is made, rather than making you poll for it.

Payload

Every delivery is a POST with a JSON body:

{
  "event": "gate.passed",
  "guild_id": 123456789012345678,
  "data": { "...": "event-specific fields" },
  "webhook_id": 42,
  "timestamp": "2026-04-23T14:30:15Z"
}

Useful headers on each request:

Verifying the signature

Each request is signed so you can trust it came from HoneyGate. The signature is an HMAC-SHA256 of the raw JSON body, using your subscription's secret, sent as:

X-HoneyGate-Signature: sha256=<hex digest>

To verify, compute HMAC-SHA256(rawBody, yourSecret) and compare it against the value after sha256=. Use a constant-time compare. If they don't match, reject the request.

// Node.js example
const crypto = require('crypto');
const expected = 'sha256=' + crypto
  .createHmac('sha256', YOUR_SECRET)
  .update(rawBody)            // the exact bytes you received
  .digest('hex');
const ok = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sigHeader));

Delivery & retries