Webhooks

Your ICR App can subscribe to webhook events to receive notifications whenever activity occurs.

About webhooks and ICR apps

Webhooks enable your ICR App to receive real-time notifications when events happen on ICR, such as when someone transfers credits from an organization's inventory that your app can access.

You can configure your ICR App to receive webhooks for specific events on ICR and automatically take action on them. For more information about the types of webhooks you can receive, see "Webhook actions and payloads."

To receive webhook events in your ICR App, you must enable webhooks for your ICR App registration and specify a webhook URL where ICR will send the webhook payloads.

If your ICR App does not need to respond to webhooks, you can turn off the webhook function for your ICR App registration. You do not need to specify a webhook URL.

For more information about registering an ICR App, see "Registering an ICR App."

Choosing a webhook URL

When you activate webhooks for your ICR App registration, you will need to specify a webhook URL. The webhook URL is the address of a web server that will receive the webhook event payloads sent to your ICR App. The server can then take action based on the content of the payload. You should choose a web server that's appropriate for the volume of webhook traffic that your ICR App will encounter.

Securing your webhooks with a webhook secret

Once you've configured your server to receive payloads, it will listen for any payload sent to the server. For security reasons, you should limit incoming requests to only those originating from ICR. You can do that by creating a webhook secret for your app.

To create a webhook secret for your ICR App, type a secret token under "Webhook secret" on your ICR App registration page. You should choose a random string of text with high entropy. For more information, see "Registering an ICR App" .

After creating a webhook secret for your app, you will need to configure your server to securely store and validate the webhook secret token. For more information, see "Validating webhook deliveries."