Webhook

This is the way out for the channels with Handed over by webhook switched on: where their posts are handed over, and how whatever receives them proves they came from Reelwire. You find it under Connections, then Webhook; it used to be called Publishing. What every hand-over sent, by email, by webhook and by platform connector, is on Activity, under What went out. It needs the Administration permission, which is also what saving the address, Test delivery and Deliver again need, and it is separate from API keys on purpose. A key goes into the script that sends data in. What is on this page goes into whatever receives posts going out. The two are set up at different times by different people.

When a post is due it is handed over, by email, by webhook or both, as each channel says under Channels, and whoever receives it posts it: your own script, an automation or a posting service behind the webhook, or a person reading the email. A channel handed over by email only needs nothing on this screen, and its emails still show in What went out on Activity. So do the posts a channel's platform connector made, whose credentials are set on the channel itself.

The Guides chapter has a guide for each kind of receiver: Handed over by webhook.

Your webhook address

The card Set your webhook address sets the one address the whole workspace's webhook calls go to, and shows how a receiver proves they came from Reelwire. Type it into Webhook address (an https address, up to 2,048 characters) and press Save. Every kind of call goes there: a post to hand over, a change to one, a request to take one down, and a test. A post going to several channels with Handed over by webhook switched on arrives as one signed call carrying every channel of the batch. Webhooks has what a call carries, how to answer it and how to report back once a post is up.

The signing secret is all a receiver needs: every workspace has its own, so a delivery that verifies with it is from this workspace. How to check it, header by header, is in Webhooks.

Test delivery, beside Save, sends a signed test call to the saved address now and says what came back, in a green box ("Delivered: the receiver answered 200 in 184 ms") or a red one ("Not delivered." and why; where the receiver refused the signature, a reminder that it needs this workspace's current secret). It arrives exactly as a real hand-over does, about no post, so a receiver's signature check can be tried before a real post reaches it. It is offered once the address is saved, not while the field holds a change you have not saved, and every test is a line in What went out on Activity. Its answer goes away as soon as the address is changed or the secret rotated, since it was about the old ones.

The signing secret sits in a panel of its own, showing only its start and end. Two buttons sit under it. Copy the secret asks for the password you sign in with and, on Show secret, shows the whole secret with Copy, as an API key's Copy does: wrong passwords count towards the same limit as signing in, and every time it is shown is written to the workspace's audit trail. Rotate the secret opens a dialogue that says what rotating breaks before anything happens, and Rotate now has Reelwire make the new secret. It then opens in a dialogue of its own, Your new signing secret, with Copy; I have saved it closes it, and Copy the secret shows it again later. It takes effect on the next call: anything still verifying with the old secret starts rejecting until you update it, so rotate when you can deploy the new secret, not before. Only a person signed in can show or rotate the secret: no API key can, because both hand it out.

Get your code

The card Get your code, under the webhook card, is a working receiver to copy into your own system, in Node.js, Python, PHP or C#: choose the language above the code. It checks each call's signature with your signing secret, refuses a call older than five minutes, skips a retry of a delivery it has handled already, and for every channel of a hand-over reports the post back once you have posted it, which moves it from Handed over to Published on Posts. Two values stand in for your secrets: YOUR_SIGNING_SECRET, the secret above (Copy the secret shows it), and YOUR_API_KEY, a key with the Posts: write permission from API keys. The report goes to this Reelwire's own address, so the code works as it is.