Webhooks: connecting CourseKit to other tools

A webhook is a message CourseKit sends out itself: whenever something happens - someone is unlocked, a lesson is finished, access is running out - we send a message to an address of your choice. What happens there is up to you: a row in a spreadsheet, a contact in your newsletter tool, a note in your team chat.

It is how you connect what CourseKit does not do itself. You do not need to write code if you use Zapier or Make: both accept webhooks and build the next step from them.

1. 1In Zapier or Make, create a flow with the “Webhook” trigger and copy the address it shows you.
2. 2In CourseKit, go to “Settings” → “Integrations”, choose “Add target” and paste the address.
3. 3Pick the events you want - picking none means all of them.
4. 4Copy the signing secret shown once afterwards. You will not see it again; with “Replace secret” you create a new one, and the old one stops working at once.
5. 5Unlock a course as a test and check under “Deliveries” that it was delivered.

Note: The address has to start with https://. Addresses pointing into an internal network are refused. Up to ten targets are possible.

Note: Outgoing webhooks are available on the Growth and Pro plans and during the trial. Before a switch to Starter you remove your targets – “Plan & billing” tells you so when you switch.

• Member created - someone gets access for the first time
• Course unlocked - access was created, by purchase or by hand
• Lesson completed - someone ticked a lesson off or passed a quiz
• Course completed - every lesson of a course is ticked off
• Access expiring - 14 and 3 days before
• Access expired - the day after
• Certificate issued - automatically or by you

An extension is not an unlock: “Course unlocked” only arrives when access is newly created.

If your target does not answer with a success, we try again six times over roughly 36 hours - after a minute, five minutes, half an hour, two, six and 24 hours. After that the delivery is “given up” and you can repeat it by hand with “Send again”.

We never switch a target off by ourselves. Failed attempts are shown on the target so you can see that something is stuck.

Note: While a target is paused it receives nothing - and nothing is caught up when you switch it back on.

Every request is a POST with JSON and carries the header ck-signature in the form t=<timestamp>,v1=<signature>. The signature is an HMAC-SHA256 over the string “<timestamp>.<raw body>” with your secret.

Verify the signature against the raw body before you parse the JSON, and refuse requests whose timestamp is more than a few minutes old. Answer with a status code between 200 and 299, otherwise we retry.

Every request also carries an event id (ck-event-id). If the same id arrives twice it is the same message - process it once.