Webhooks Overview

User's score crosses threshold
          ↓
ChurnKit signs payload with HMAC-SHA256
          ↓
POST https://yourapp.com/hooks/churn-alert
          ↓
Your server verifies signature → processes alert

{
  "event": "churn_risk_alert",
  "userId": "user_123",
  "score": 0.84,
  "tier": "high",
  "signals": ["no_login_7d", "support_spike", "export_all_data"],
  "recommendation": "This user is at high risk. Reach out immediately.",
  "triggeredAt": "2024-06-01T14:22:00Z"
}

// Always return 200 quickly — process async if needed
export async function POST(req: Request) {
  const body = await req.text()

  // Verify first
  const valid = await verifyWebhookSignature(
    body,
    req.headers.get('x-churnkit-signature') ?? '',
    process.env.CHURNKIT_WEBHOOK_SECRET!
  )
  if (!valid) return new Response('Unauthorized', { status: 401 })

  // Acknowledge immediately, process async
  const payload = JSON.parse(body)
  processAlertAsync(payload) // don't await

  return Response.json({ ok: true })
}

CHURNKIT_WEBHOOK_SECRET=whsec_your_secret_here