Afilipost ← Back to the front page

Webhooks

Stop polling — Afilipost calls you, with a signature you can verify.

Instead of polling for status, register an endpoint in the panel (Notifications screen) and Afilipost calls you. The secret used to sign every request is shown once, at creation.

Events

Event When
post.published A target went live — data carries the permalink and platform post id.
post.failed A target failed permanently or ran out of retries; data.error says why.
account.expired A connected account's session died and needs reconnecting.
dm.received A direct message arrived — rule-matched or not. Pair it with the reply endpoint and your own AI can run the inbox.
comment.received A comment arrived on one of the connected account's posts.
webhook.test Sent by the panel's test button.

The request you receive

POST <senin-adresin>
Content-Type: application/json
X-Afilipost-Signature: t=1756120800,v1=9f2c…c1

{ "type": "post.failed",
  "createdAt": "2026-08-25T12:40:00.000Z",
  "data": {
    "postId": "0f7a…42",
    "targetId": "3b1d…9e",
    "accountId": "8b1e…7d",
    "platform": "youtube",
    "error": "YouTube günlük yükleme hakkı doldu…" } }

Answer with any 2xx within 10 seconds. Anything else counts as a failure.

Verifying the signature

v1 is an HMAC-SHA256 of `${t}.${raw body}` with your secret. The timestamp lives inside the signature, so a captured request cannot be replayed later: 

import hashlib, hmac, time

def verify(secret, body, header, tolerance=300):
    parts = dict(p.split("=", 1) for p in header.split(","))
    if abs(time.time() - int(parts["t"])) > tolerance:
        return False          # eski istek — tekrar oynatma koruması
    mac = hmac.new(secret.encode(),
                   f"{parts['t']}.{body}".encode(),
                   hashlib.sha256).hexdigest()
    return hmac.compare_digest(mac, parts["v1"])

Delivery and retries