Webhooks out | Sporetag Docs

Post each customer profile, and optionally each order, to Zapier, Make, n8n or your own server. Signed, retried, and testable.

A webhook sends each customer profile to an address you choose, as JSON. Use it to reach any tool through Zapier, Make or n8n, or your own server. It carries the same fields as the HubSpot and GoHighLevel push.

It is on paid plans: Solo, Studio, Agency and Custom. Free does not include it.

Set up

In Zapier, Make or n8n, start a flow with a Webhook trigger that catches a POST. Copy its address.
In Sporetag, open your site, then Integrations. Under CRMs and sending, click Set up next to Webhook.
Paste the address and click Save. It must start with https:// and be on a public host name.
Click Send test. Sporetag posts a sample event, marked "test": true, and shows the answer.
Build the rest of your flow from the test event.
Tick the fields to send and click Start sending.

Tick Also send one event per order to get orders, renewals and won deals too.

Events

Each request is one event. Every event has the same outer shape:

JSON

{
  "id": "evt_3f9c2a7b1d0e4c55a8e2f901",
  "type": "profile.updated",
  "created": "2026-10-23T14:02:11.000Z",
  "site": { "id": "a4bd9d08183f00a2", "domain": "plantshop.com" },
  "data": {
    "profile_id": "Xk29dLq0aB7cZp",
    "email": "sam@example.com",
    "name": "Sam Rivera",
    "currency": "USD",
    "sporetag_first_source": "instagram",
    "sporetag_first_campaign": "spring-sale",
    "sporetag_first_platform": "Meta",
    "sporetag_first_seen": "2026-10-01",
    "sporetag_last_source": "google",
    "sporetag_landing_page": "/shop",
    "sporetag_short_link": "go.sporetag.com/spring",
    "sporetag_visits": 4,
    "sporetag_revenue": 120,
    "sporetag_orders": 2,
    "sporetag_profile_url": "https://sporetag.com/app/s/a4bd9d08183f00a2/customers/Xk29dLq0aB7cZp"
  }
}

This is demo data. Only the fields you ticked are in data, and a field with no value is left out.

Type	When	`data`
`profile.updated`	A person with an email is new or changed	The profile, as above
`order.created`	An order, renewal or won deal, if you turned orders on	`order_id`, `profile_id`, `email`, `occurred_at`, `value`, `currency`, `source`, `kind`, `title`
`test`	You clicked Send test	A sample profile

The Sporetag-Event header holds the type too.

Check the signature

Each request has a Sporetag-Signature header:

Code

Sporetag-Signature: t=1792764131,v1=5f2b...e9

t is the time in Unix seconds. v1 is a hex HMAC-SHA256 of t, a dot, and the raw body, made with your signing secret. Find the secret under Signing secret on the webhook page.

To check a request:

Read t and v1 from the header.
Compute HMAC-SHA256 of t + "." + body with the secret, as hex.
Compare it with v1. Reject the request if they differ, or if t is more than 5 minutes old.

Make a new secret replaces it at once. Update it where you check signatures.

Retries

An answer other than 2xx within 10 seconds is a failure. Sporetag tries again after 1, 5, 15, 30, then 60 minutes. From the sixth failure in a row, the row says Needs attention, and Sporetag keeps trying every 15 minutes.

A retry can send an event you already got. Use id to skip one you have seen: the same profile with the same values has the same id.

When events go out

Right away when your site identifies someone with an email.
Within 15 minutes for everyone else whose profile changed.
Send everyone now sends every profile once more.

People with no email are not sent. While Show contact details is off, nobody is sent, since Sporetag keeps only hashed emails.

Stop

Stop sending pauses it. Disconnect deletes the address and the secret.