Outgoing Webhooks

Outgoing webhooks notify external applications whenever records are created, updated, or deleted in your PocketBase collections.

---

Event Dispatch & Verification Sequence

sequenceDiagram
    autonumber
    actor Client as Client / Mobile App
    participant PB as PocketBase Database
    participant Hook as Webhook Engine
    participant Ext as External Webhook (Slack / Discord / n8n)

    Client->>PB: POST /api/records/orders
    PB->>PB: Insert record in SQLite (WAL)
    PB->>Hook: Trigger record.create event
    Hook->>Hook: Compute HMAC-SHA256 signature with secret
    Hook->>Ext: POST JSON payload (X-Fuko-Signature header)
    Ext-->>Hook: 200 OK Delivery Acknowledgment
    PB-->>Client: 201 Created Order Confirmation

---

Webhook Payload Structure

{
  "event": "record.create",
  "timestamp": "2026-08-18T06:00:00.000Z",
  "instance_id": "inst_99x87a1",
  "collection": "orders",
  "data": {
    "id": "rec_01h8q54",
    "customer_email": "jane@example.com",
    "amount": 149.00,
    "status": "paid"
  }
}

---

Verifying HMAC-SHA256 Signatures

Every webhook includes an X-Fuko-Signature header computed using HMAC-SHA256 and your signing secret:

import crypto from 'crypto';

function verifyWebhook(payloadString, signatureHeader, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payloadString)
    .digest('hex');
  return crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected));
}