Webhooks: Real-Time Link Events for Your Automation Stack

The Problem with Polling

You've shared a proposal link with a prospect. Now what? Refreshing the analytics dashboard every ten minutes isn't a workflow—it's a distraction. And if you're trying to connect link activity to downstream systems (Slack alerts, CRM updates, lead scoring), polling an API on a schedule means delays, wasted requests, and brittle scripts.

Webhooks flip the model. Instead of asking HTMLvault "has anything happened?" over and over, you tell us where to send events and we push them to you the moment they occur. Link created? You know instantly. Prospect viewed your deck? Your Slack channel lights up before they've finished scrolling.

Who This Is For

RevOps and sales ops teams building real-time lead routing. When a high-value prospect opens a proposal, you want that signal in Salesforce or HubSpot immediately—not on your next API sync fifteen minutes later.

Marketers running personalized follow-up sequences. A webhook can trigger a Zapier workflow that sends a follow-up email within minutes of a link view.

Developers and integration builders connecting HTMLvault to internal tools. Webhooks are the standard event-delivery mechanism for a reason: they're simple, stateless, and work with any stack that can receive HTTP POST requests.

How Webhooks Work

When an event occurs—a link is created or viewed—HTMLvault sends an HTTP POST request to a URL you've registered. The request body contains a JSON payload with event details: event type, link ID, timestamp, and (for view events) analytics metadata like device type, geo, and referrer.

Every request is signed with HMAC-SHA256. You provide a secret when registering the webhook; we use that secret to generate a signature included in the request headers. Your server recalculates the signature using the same secret and compares. If they match, you know the request is authentic and hasn't been tampered with.

How to Enable Webhooks

Webhooks are available on Pro and Enterprise plans. Free-tier users can explore the settings panel but will need to upgrade to register endpoints.

Step 1: Open Webhook Settings

Navigate to Settings → Integrations → Webhooks in your HTMLvault dashboard. You'll see a list of any existing webhooks and a button to add a new one.

Step 2: Register an Endpoint

Click Add Webhook. Enter the URL where you want to receive events—this must be an HTTPS endpoint that can accept POST requests. Then select which events to subscribe to: link.created, link.viewed, or both.

HTMLvault generates a signing secret automatically. Copy this secret and store it securely; you'll need it to verify incoming requests. You can regenerate the secret later, but doing so invalidates the old one immediately.

Step 3: Verify the Signature

Each webhook request includes an X-HTMLvault-Signature header. This is an HMAC-SHA256 hash of the raw request body, using your signing secret as the key. On your server, compute the same hash and compare. Here's pseudocode:

expected = hmac_sha256(signing_secret, request_body)
if secure_compare(expected, request_header['X-HTMLvault-Signature']):
    process_event()
else:
    reject_request()

Use a constant-time comparison function to prevent timing attacks. Most languages have one built in or available in a crypto library.

Example: Slack Alert on Link View

A sales rep shares a pricing proposal. They want a Slack message the moment the prospect opens it—no dashboard refreshing, no waiting.

1. Create a Slack Incoming Webhook URL for the relevant channel (Slack's docs walk through this in two minutes).
2. Set up a lightweight relay—this could be a Zapier webhook trigger, a Pipedream workflow, or a simple serverless function—that receives the HTMLvault event, verifies the signature, and forwards a formatted message to Slack.
3. Register that relay URL in HTMLvault with link.viewed selected.

When the prospect opens the link, the rep sees a Slack notification within seconds: "Your proposal was just viewed from San Francisco on Chrome (desktop)."

Limits and Caveats

• Pro users can register up to 5 webhooks. Enterprise customers can request higher limits via their account manager.
• Endpoints must be HTTPS. Plain HTTP URLs will be rejected.
• Timeouts: Your endpoint must respond with a 2xx status within 10 seconds. If it doesn't, HTMLvault will retry with exponential backoff up to 5 times over the following hour.
• Payload size: View events include metadata (geo, device, referrer) but not full page content. Payloads are typically under 2 KB.
• Event ordering: Events are delivered as they occur, but network variability means they may arrive out of order. Use the timestamp field if sequencing matters.

Why This Matters

For the sales rep waiting to hear back on a proposal, webhooks turn passive hoping into active awareness. The moment a prospect engages, you know. For RevOps, webhooks are the connective tissue that lets HTMLvault slot into your existing automation—no custom polling scripts, no brittle cron jobs. And because every payload is HMAC-signed, your IT team can verify that the data hitting your systems is genuine, not spoofed.

Real-time event delivery isn't a nice-to-have for modern sales workflows. It's the difference between following up tomorrow and following up while you're still top of mind.