Webhooks

Webhooks let you receive HTTP POST requests when things happen in your Tickable account, like a new order or a scanned ticket.

Supported Events

Event	Description	Status
`order.created`	A new order has been placed	Coming soon
`order.confirmed`	An order payment has been confirmed	Available
`ticket.scanned`	A ticket was scanned at the door	Coming soon
`ticket.cancelled`	A ticket was cancelled	Coming soon

Creating a Webhook

You can create webhooks via the API or from the Tickable dashboard.

curl -X POST https://api.tickable.io/webhooks \
  -H "Authorization: Bearer tk_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://yourapp.com/webhook",
    "event_types": ["order.confirmed"],
    "description": "Production webhook"
  }'

Your webhook endpoint must be publicly accessible and respond with a 2xx status code within 10 seconds.

The response contains a secret (whsec_...). It is only returned once, so store it right away: you need it to verify deliveries.

Receiving Webhooks

When an event occurs, Tickable sends a POST request to your URL:

{
  "event_type": "order.confirmed",
  "timestamp": "2026-04-09T14:30:00Z",
  "data": {
    "order_id": "550e8400-e29b-41d4-a716-446655440000",
    "event_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7"
  }
}

Example Handler

app.post('/webhook', express.json(), (req, res) => {
  const { event_type, data } = req.body;

  switch (event_type) {
    case 'order.confirmed':
      console.log('Order confirmed:', data.order_id);
      break;
  }

  res.sendStatus(200);
});

@app.route('/webhook', methods=['POST'])
def webhook():
    payload = request.get_json()
    event_type = payload['event_type']

    if event_type == 'order.confirmed':
        print(f"Order confirmed: {payload['data']['order_id']}")

    return '', 200

Verifying Signatures

Every delivery to a webhook with a secret carries a Tickable-Signature header:

Tickable-Signature: t=1760000000,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

v1 is an HMAC-SHA256 of {t}.{raw request body} with your webhook secret as the key, hex encoded. Compute it yourself, compare it in constant time, and reject deliveries whose t is more than 5 minutes old, so a captured request cannot be replayed.

import crypto from 'node:crypto';

function verifyTickableSignature(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const expected = crypto.createHmac('sha256', secret).update(`${parts.t}.${rawBody}`).digest('hex');
  const valid = parts.v1?.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
  return valid && Math.abs(Date.now() / 1000 - Number(parts.t)) <= toleranceSeconds;
}

// Use the raw body: re-serialized JSON will not match the signature
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyTickableSignature(req.body.toString(), req.get('Tickable-Signature') ?? '', process.env.TICKABLE_WEBHOOK_SECRET)) {
    return res.sendStatus(400);
  }
  const { event_type, data } = JSON.parse(req.body);
  // ...
  res.sendStatus(200);
});

import hmac, hashlib, time

def verify_tickable_signature(raw_body: bytes, header: str, secret: str, tolerance=300) -> bool:
    parts = dict(p.split('=', 1) for p in header.split(','))
    expected = hmac.new(secret.encode(), f"{parts.get('t')}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(parts.get('v1', ''), expected) and abs(time.time() - int(parts.get('t', 0))) <= tolerance

@app.route('/webhook', methods=['POST'])
def webhook():
    if not verify_tickable_signature(request.get_data(), request.headers.get('Tickable-Signature', ''), WEBHOOK_SECRET):
        return '', 400
    payload = request.get_json()
    return '', 200

Older integrations may check X-Webhook-Signature: sha256={hmac of the body}. It is still sent, but it does not protect against replays; switch to Tickable-Signature.

Getting Attendee Details

The order.confirmed payload identifies the order; it does not contain the individual tickets. To get each attendee — including the Visitor Information they filled in — call the Tickets API with the order_id from the webhook:

curl "https://api.tickable.io/events/{event_id}/tickets?order_id={order_id}"   -H "Authorization: Bearer tk_live_YOUR_API_KEY"

Every ticket in the response carries its own metadata object, keyed by the Visitor Information field keys. See Visitor Information for the exact shape.

In Zapier or Make, chain a Webhooks by Zapier → GET step after the trigger, then use a Looping step over data[] so each ticket becomes its own action — one Kajabi contact per participant, with that participant’s own name and email.

Managing Webhooks

List All Webhooks

curl https://api.tickable.io/webhooks \
  -H "Authorization: Bearer tk_live_YOUR_API_KEY"

Delete a Webhook

curl -X DELETE https://api.tickable.io/webhooks/7c9e6679-7425-40de-944b-e07fc1f90ae7 \
  -H "Authorization: Bearer tk_live_YOUR_API_KEY"

Best Practices

Always respond quickly to webhook requests. If you need to do heavy processing, acknowledge the webhook with a 200 and process the data asynchronously.

Respond fast — return 200 immediately, process in the background
Handle duplicates — webhooks may be delivered more than once; the Tickable-Webhook-Id header is the same on every retry, so use it to deduplicate
Verify every delivery — check Tickable-Signature before you trust the payload
Subscribe only to what you need — reduce noise by selecting specific event types

Getting Started

Guides

Supported Events

Creating a Webhook

Receiving Webhooks

Example Handler

Verifying Signatures

Getting Attendee Details

Managing Webhooks

List All Webhooks

Delete a Webhook

Best Practices

​Supported Events

​Creating a Webhook

​Receiving Webhooks

​Example Handler

​Verifying Signatures

​Getting Attendee Details

​Managing Webhooks

​List All Webhooks

​Delete a Webhook

​Best Practices

Supported Events

Creating a Webhook

Receiving Webhooks

Example Handler

Verifying Signatures

Getting Attendee Details

Managing Webhooks

List All Webhooks

Delete a Webhook

Best Practices