Webhooks Overview

What are webhooks?

Webhooks let your application receive real-time HTTP POST notifications when events happen in your Anderro affiliate program - such as when an affiliate signs up through a referral link or when a commission is generated.

Setup

1. Go to your product's settings in the Anderro dashboard
2. Navigate to the Webhooks tab
3. Enter your endpoint URL (must be HTTPS)
4. Select the events you want to receive
5. Save - Anderro will generate a webhook secret for signature verification

Webhook payload

All webhook deliveries are HTTP POST requests with a JSON body:

{
  "id": "evt_cm1abc2def3",
  "event": "affiliate.signup",
  "created_at": "2026-04-08T12:00:00.000Z",
  "data": {
    "customer_email": "[email protected]",
    "affiliate": {
      "email": "[email protected]",
      "name": "Jane Smith",
      "referral_code": "jane-smith"
    },
    "product": {
      "id": "cuid_abc123",
      "name": "My SaaS"
    }
  }
}

Security headers

Every webhook request includes two headers for signature verification:

Verifying signatures

To verify a webhook is genuinely from Anderro, compute the HMAC-SHA256 signature and compare it with the header value:

import { createHmac } from "crypto";

function verifyWebhook(payload, signature, timestamp, secret) {
  const message = `${timestamp}.${payload}`;
  const expected = createHmac("sha256", secret)
    .update(message)
    .digest("hex");

  return expected === signature;
}

// In your webhook handler:
app.post("/webhooks/anderro", (req, res) => {
  const signature = req.headers["x-webhook-signature"];
  const timestamp = req.headers["x-webhook-timestamp"];
  const payload = JSON.stringify(req.body);

  if (!verifyWebhook(payload, signature, timestamp, WEBHOOK_SECRET)) {
    return res.status(401).send("Invalid signature");
  }

  // Process the event
  const event = req.body;
  console.log(`Received ${event.event}:`, event.data);

  res.status(200).send("OK");
});

Delivery behavior

• Timeout: Anderro waits up to 5 seconds for your endpoint to respond
• Expected response: Return any 2xx status code to acknowledge receipt
• Delivery log: All delivery attempts are logged and visible in your dashboard under the Webhooks tab

Test webhooks

You can send test webhooks from the dashboard to verify your endpoint is working correctly. Test events include a "test": true field in the payload so you can distinguish them from real events.

Available events

Tracking events

Affiliate lifecycle events

Commission & payout events