> ## Documentation Index
> Fetch the complete documentation index at: https://developers.kit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting started with webhooks

> Create an endpoint, subscribe to events, and receive your first delivery

This guide takes you from zero to a verified webhook delivery. You'll create an endpoint, subscribe it to an event, and confirm you can receive and verify a delivery.

## Prerequisites

* A Kit account on a [plan with API access](https://kit.com/pricing).
* An [API key or OAuth access token](/api-reference/authentication). Both work for managing endpoints; OAuth-created endpoints are scoped to the app that created them.
* A publicly reachable HTTP(S) URL that can accept `POST` requests (HTTPS strongly recommended). For local development, a tunnel such as ngrok works well.

<Tip>
  No receiver yet? Create a temporary URL at [webhook.site](https://webhook.site) and register that as the endpoint. It shows every delivery Kit sends, headers and body included, so you can trigger a real event and inspect the payload before writing any code. Swap in your own URL when the receiver is ready.
</Tip>

<Steps>
  <Step title="Create an endpoint">
    Register your URL and the events it should receive. The response includes a `secret` — **this is the only time it's returned in plaintext**, so store it now; you'll need it to [verify signatures](/webhooks/verifying-signatures).

    ```bash theme={null}
    curl -X POST https://api.kit.com/v4/webhook_endpoints \
      -H "X-Kit-Api-Key: <your-api-key>" \
      -H "Content-Type: application/json" \
      -d '{
        "url": "https://example.com/kit/webhooks",
        "events": ["subscriber.created"]
      }'
    ```

    <ResponseExample>
      ```json theme={null}
      {
        "webhook_endpoint": {
          "id": 42,
          "name": "Webhook 1",
          "url": "https://example.com/kit/webhooks",
          "events": ["subscriber.created"],
          "status": "active",
          "source": "creator",
          "description": null,
          "created_by_app": null,
          "created_at": "2026-07-29T14:30:00Z",
          "previous_secret_expires_at": null,
          "secret": "whsec_9f8a...store-me"
        }
      }
      ```
    </ResponseExample>
  </Step>

  <Step title="Subscribe to more events (optional)">
    Update the endpoint's event set at any time. The `events` array replaces the current subscriptions.

    ```bash theme={null}
    curl -X PATCH https://api.kit.com/v4/webhook_endpoints/42 \
      -H "X-Kit-Api-Key: <your-api-key>" \
      -H "Content-Type: application/json" \
      -d '{ "events": ["subscriber.created", "subscriber.activated"] }'
    ```

    Browse everything you can subscribe to in the [event types catalog](/webhooks/event-types).
  </Step>

  <Step title="Receive a delivery">
    Trigger the event (for `subscriber.created`, add a subscriber to the account). Kit sends a `POST` to your URL with the [envelope](/webhooks/delivery-format):

    ```json theme={null}
    {
      "delivery_id": 123456,
      "events": [
        {
          "id": "9c2e1f3a-6b7d-4e8f-a1b2-c3d4e5f60718",
          "type": "subscriber.created",
          "created": "2026-07-29T14:32:10Z",
          "data": { "subscriber": { "id": 987654, "email_address": "ada@example.com", "...": "..." } }
        }
      ]
    }
    ```

    `events` is always an array — usually one event, but bulk activity batches up to 100 per delivery, so iterate it rather than reading a single event. Respond with any `2xx` status to acknowledge receipt. Non-`2xx` responses (or timeouts) are [retried](/webhooks/retries).
  </Step>

  <Step title="Verify the delivery">
    Every delivery carries an `X-Kit-Signature` header. Recompute the HMAC with your stored secret and compare before trusting the payload — see [Verifying signatures](/webhooks/verifying-signatures) for ready-to-paste code.
  </Step>
</Steps>

<Tip>
  Return `2xx` within 10 seconds and do slow work asynchronously. Kit waits 5 seconds to connect and 10 seconds for your response; past that the delivery counts as failed and gets [retried](/webhooks/retries), even if your handler eventually finished the work.
</Tip>


## Related topics

- [Create a webhook endpoint](/api-reference/webhooks/create-a-webhook-endpoint.md)
- [Quick start guide](/kit-app-store/quick-start-guide.md)
- [API Overview](/api-reference/overview.md)
- [API Authentication](/api-reference/authentication.md)
- [Kit App Store overview](/kit-app-store/overview.md)