API

Webhooks

Subscribe to signed Qorlivo link events, verify delivery signatures, test endpoints, and handle retries.

Webhooks let your app receive notifications when Qorlivo link events happen. Configure webhooks from Settings, then Developers in the dashboard.

Availability

Webhooks require Pro, Business, or Enterprise.

Add a webhook

Open Settings.
Go to Developers.
Choose Add webhook.
Enter an HTTPS endpoint URL.
Choose the events you want.
Add a signing secret.
Save.
Send a test event.

Webhook URLs must use HTTPS. Keep the signing secret private.

Events

Event	When it fires
`link.created`	A short link is created.
`link.updated`	A link destination, title, preview field, or protected setting changes.
`link.deleted`	A short link is permanently deleted.
`link.activated`	An archived link is restored.
`link.deactivated`	An active link is archived.
`test.ping`	A test event sent from the dashboard.

Payload format

Qorlivo sends JSON with an event name, data object, and timestamp.

{
  "event": "link.created",
  "data": {
    "linkId": "j97xxxxxxxxxxxxxxxxxxxxxxxxx",
    "slug": "promo-2026",
    "destinationUrl": "https://example.com/landing",
    "title": "Spring promo",
    "createdAt": "2026-05-26T18:42:00.000Z"
  },
  "timestamp": 1783027439000
}

Delivery headers

Content-Type: application/json
X-Qorlivo-Signature: hmac-sha256-signature
X-Qorlivo-Event: link.created
X-Qorlivo-Delivery-Attempt: 1

Test deliveries set:

X-Qorlivo-Delivery-Attempt: test

Verify signatures

X-Qorlivo-Signature is a lowercase hex HMAC-SHA256 signature of the raw request body using your webhook secret.

Node.js example:

import crypto from "node:crypto"

function verifyQorlivoWebhook(rawBody, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex")

  return crypto.timingSafeEqual(
    Buffer.from(signature, "hex"),
    Buffer.from(expected, "hex")
  )
}

Verify against the raw body bytes before parsing JSON. Reject requests with missing signatures or mismatched signatures.

Retries

Qorlivo retries non-2xx responses and network failures up to five times.

Retry	Delay before retry
1	10 seconds
2	30 seconds
3	90 seconds
4	270 seconds
5	810 seconds

Return a 2xx response only after your endpoint has safely accepted the event. If your endpoint returns an error or times out, Qorlivo may deliver the same event again.

Endpoint recommendations

Respond within 10 seconds.
Verify the signature before processing.
Store event IDs or use event data to avoid duplicate side effects.
Return 2xx after accepting the event, then do slower work asynchronously in your own system.
Keep webhook secrets out of source control.
Use the dashboard test button before relying on a webhook in production workflows.