> ## Documentation Index
> Fetch the complete documentation index at: https://docs.politicalcomms.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setup & Configuration

> Add a webhook endpoint, subscribe to events, copy the signing secret, and send a test webhook.

<Steps>
  <Step title="Open the Webhooks admin">
    From the dashboard, go to **Admin → Webhooks** in the left navigation menu.
  </Step>

  <Step title="Add an endpoint">
    Click **Add Endpoint** and configure:

    * **Endpoint name** - A descriptive label (e.g. "CRM sync - production").
    * **HTTPS URL** - Your receiving endpoint. Must be HTTPS in production.
    * **Event subscriptions** - Tick the events you want to receive. You can subscribe to one or many.
  </Step>

  <Step title="Copy and store the signing secret">
    Copy the webhook signing secret and store it securely (a secret manager, not source control). You will need it to validate signatures. The secret is shown only once.
  </Step>

  <Step title="Send a test webhook">
    Click **Send Test Webhook** to verify end-to-end delivery. Your endpoint should return `200` within 10 seconds.
  </Step>
</Steps>

## Receiving payloads

Webhooks arrive as `POST` requests with `Content-Type: application/json`. The body is JSON; the headers tell you what kind of event, when it occurred, and how to validate the signature.

```http theme={null}
POST /your-webhook-endpoint HTTP/1.1
Host: your-domain.com
Content-Type: application/json
X-Webhook-Signature: sha256=abc123...
X-Event-Type: message.delivered
X-Event-ID: msg_7f8a9b0c1d2e3f4g
X-Timestamp: 1705488600
```

The payload body and per-event examples are documented on the [event types](/api-reference/webhooks/events) page.

## Where to go next

<CardGroup cols={2}>
  <Card title="Validate signatures" icon="shield-check" href="/api-reference/webhooks/signature-validation">
    HMAC-SHA256 validation pattern + Node.js example.
  </Card>

  <Card title="Retry policy" icon="rotate-right" href="/api-reference/webhooks/retry-policy">
    What happens if your endpoint is unavailable.
  </Card>
</CardGroup>