Webhooks and integrations

Webhooks (Label plan) push events into your own tools: a CRM that should learn about new fans, a Slack channel that should hear when a release converts, a data warehouse keeping its own copy. Every delivery is signed, retried with backoff, and logged with its response code — "did you actually call us" always has an answer.

If the workspace leaves the Label plan, delivery pauses rather than breaks: endpoints are kept frozen with their configuration and secrets intact, nothing is deleted because billing changed, and deliveries resume when the plan returns.

1. 1

   Add an endpoint

   Integrations → Webhooks → Add endpoint. HTTPS only. Pick the events you want, or none to receive all. The signing secret is shown exactly once at creation — store it; it cannot be recovered, only regenerated by recreating the endpoint.

2. 2

   Verify the signature

   Each delivery carries X-DropRoute-Signature: sha256=<HMAC of the raw body with your secret>. Compute the same HMAC on your side and compare. Fan events carry ids only, never an email address — a webhook receiver is outside the privacy boundary.

3. 3

   Send a test ping and watch the log

   The Send test ping button queues a signed ping delivery to that endpoint; the recent-deliveries log shows its status code within moments. Failed deliveries retry with exponential backoff; an endpoint that fails twenty times in a row is switched off with the reason shown, rather than hammered forever.

4. 4

   Set the workspace’s default pixels

   The same Integrations area holds Default tracking pixels: Meta, TikTok, Google Analytics, and Google Ads IDs applied to every published page in the workspace, on plans that include pixels (Artist and up). A link’s own Tracking tab overrides them per vendor, and nothing loads on the page until the visitor consents — the tag scripts are not even fetched before the yes.