Webhooks

For developers. TweakTick can send a signed HTTPS request to your own server when something happens in your workspace.

Add a webhook

Open Settings → Webhooks.
Enter your Endpoint URL. It must be a public https address. Private, local and IP addresses are refused.
Pick the Events you want. If you like, choose only some projects, and under Comments pick All comments, New threads only or Replies only.
Copy the signing secret. It is shown only once.

Events

Comment created, updated, resolved and reopened.
Updated means the assignee, priority, due date or stage changed. The body's changes holds only the new values of what changed.
The stage (in_progress, ready or null) is sent only when your workspace has comment stages turned on.
Resolving or reopening a comment clears its stage. That sends a resolved or reopened event, not an updated one.
Resolved and reopened events say "actor": {"type": "guest"} when the client did it.
Pin created.
Round created, approved, and changes requested.

Check every delivery

Each delivery is a JSON POST with these headers:

X-TweakTick-Event: the event name.
X-TweakTick-Delivery: a delivery id. Retries keep the same id, so use it to ignore repeats.
X-TweakTick-Signature: t=<unix time>,v1=<signature>.

To check the signature, compute HMAC-SHA256 of t + "." + raw body with your signing secret and compare it with v1. Refuse a t older than 5 minutes.

Retries

Any 2xx answer counts as delivered. Other answers are retried, with growing waits. The delivery log in Settings → Webhooks shows each try.

What is never sent

Internal (agency-only) comments.
Client emails, tokens or signed review links.
Screenshots. Each event links back to the comment in TweakTick instead.

No-code instead?

Zapier, Make and n8n use the same events. See the API key preset.

Add a webhook

Open Settings → Webhooks.

Enter your Endpoint URL. It must be a public https address. Private, local and IP addresses are refused.

Pick the Events you want. If you like, choose only some projects, and under Comments pick All comments, New threads only or Replies only.

Copy the signing secret. It is shown only once.

Events

Comment created, updated, resolved and reopened.

Updated means the assignee, priority, due date or stage changed. The body's changes holds only the new values of what changed.

The stage (in_progress, ready or null) is sent only when your workspace has comment stages turned on.

Resolving or reopening a comment clears its stage. That sends a resolved or reopened event, not an updated one.

Resolved and reopened events say "actor": {"type": "guest"} when the client did it.

Pin created.

Round created, approved, and changes requested.

Check every delivery

Each delivery is a JSON POST with these headers:

X-TweakTick-Event: the event name.

X-TweakTick-Delivery: a delivery id. Retries keep the same id, so use it to ignore repeats.

X-TweakTick-Signature: t=<unix time>,v1=<signature>.

To check the signature, compute HMAC-SHA256 of t + "." + raw body with your signing secret and compare it with v1. Refuse a t older than 5 minutes.