Signed webhooks for your WhatsApp and inbox events.
Your tools can tell a real delivery from a forged one.
Webhook delivery
Customer message received
Otobiz sends a signed webhook to your URL whenever a conversation, send, approval, contact or channel changes.
Choose the events for each endpoint
Every delivery signed and verifiable
Failing endpoints disabled automatically
Scoped API keys you can revoke
Events your systems can use
Each event carries its type, time and business context. The details match what your activity history shows.
- Conversations and message sends
- Campaign approvals
- Contact and channel changes
- Scoped to one business
Signed and verifiable
Each endpoint has its own signing secret, shown once when you create it. Your system checks the signature before trusting a delivery.
- Signature sent with every delivery
- Enable, disable or delete endpoints anytime
- Messages
- Contacts
- Files
- Messages
- Contacts
- Files
More capabilities
Keys with scopes
API keys are created in Otobiz, shown once, then listed masked. Scopes decide what each key can reach.
- Last-used time shown for each key
- Revoke a key immediately
- Creation and revocation in the activity history
The public API
Endpoints for contacts, conversations, messages and campaigns, authenticated with your business keys. Paths are versioned, with cursor pagination and one error shape.
- Read and write endpoints
- Duplicate requests blocked before sending
Questions buyers ask
What events can I subscribe to?
Any business event from your activity history. Each endpoint receives the event types you pick for it.
How do I verify a delivery?
Compute the signature over the payload with your endpoint's secret and compare it with the one sent. Reject any delivery that does not match.
What if my endpoint goes down?
Failures are counted, and an endpoint that keeps failing is disabled. Turn it back on once your service recovers.
Can I rotate the signing secret?
Yes. A leaked secret can be replaced without deleting the endpoint or its subscriptions.
More questions
- Will I receive duplicate deliveries?
- Sometimes. Delivery is at least once, so use the event ID as the key and make your handler safe to run twice.
- Will API sends bypass consent?
- No. Any send passes the same consent, suppression, reply-window and duplicate checks as a message sent from the app.
- Can I export data instead?
- Contacts export to CSV, and webhooks give you a continuous feed of every event.