Kit Developer Documentation

This guide takes you from zero to a verified webhook delivery. You’ll create an endpoint, subscribe it to an event, and confirm you can receive and verify a delivery.

Prerequisites

A Kit account on a plan with API access.
An API key or OAuth access token. Both work for managing endpoints; OAuth-created endpoints are scoped to the app that created them.
A publicly reachable HTTP(S) URL that can accept POST requests (HTTPS strongly recommended). For local development, a tunnel such as ngrok works well.

No receiver yet? Create a temporary URL at webhook.site and register that as the endpoint. It shows every delivery Kit sends, headers and body included, so you can trigger a real event and inspect the payload before writing any code. Swap in your own URL when the receiver is ready.

Create an endpoint

Register your URL and the events it should receive. The response includes a secret — this is the only time it’s returned in plaintext, so store it now; you’ll need it to verify signatures.

curl -X POST https://api.kit.com/v4/webhook_endpoints \
  -H "X-Kit-Api-Key: <your-api-key>" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/kit/webhooks",
    "events": ["subscriber.created"]
  }'

{
  "webhook_endpoint": {
    "id": 42,
    "name": "Webhook 1",
    "url": "https://example.com/kit/webhooks",
    "events": ["subscriber.created"],
    "status": "active",
    "source": "creator",
    "description": null,
    "created_by_app": null,
    "created_at": "2026-07-29T14:30:00Z",
    "previous_secret_expires_at": null,
    "secret": "whsec_9f8a...store-me"
  }
}

Subscribe to more events (optional)

Update the endpoint’s event set at any time. The events array replaces the current subscriptions.

curl -X PATCH https://api.kit.com/v4/webhook_endpoints/42 \
  -H "X-Kit-Api-Key: <your-api-key>" \
  -H "Content-Type: application/json" \
  -d '{ "events": ["subscriber.created", "subscriber.activated"] }'

Browse everything you can subscribe to in the event types catalog.

Receive a delivery

Trigger the event (for subscriber.created, add a subscriber to the account). Kit sends a POST to your URL with the envelope:

{
  "delivery_id": 123456,
  "events": [
    {
      "id": "9c2e1f3a-6b7d-4e8f-a1b2-c3d4e5f60718",
      "type": "subscriber.created",
      "created": "2026-07-29T14:32:10Z",
      "data": { "subscriber": { "id": 987654, "email_address": "ada@example.com", "...": "..." } }
    }
  ]
}

events is always an array — usually one event, but bulk activity batches up to 100 per delivery, so iterate it rather than reading a single event. Respond with any 2xx status to acknowledge receipt. Non-2xx responses (or timeouts) are retried.

Verify the delivery

Every delivery carries an X-Kit-Signature header. Recompute the HMAC with your stored secret and compare before trusting the payload — see Verifying signatures for ready-to-paste code.

Return 2xx within 10 seconds and do slow work asynchronously. Kit waits 5 seconds to connect and 10 seconds for your response; past that the delivery counts as failed and gets retried, even if your handler eventually finished the work.

Getting started

Guides

Webhooks

Endpoints

Getting started with webhooks

Prerequisites

​Prerequisites

Prerequisites