Webhooks API

Events

Subscribe to any of the following events when creating a webhook:

Payload Structure

All webhook payloads follow this structure:

{
  "event": "booking.created",
  "timestamp": "2026-02-07T14:30:00.000Z",
  "data": {
    // Event-specific data (see below)
  }
}

HTTP Headers

Each webhook request includes these headers:

Event Payloads

{
  "event": "booking.created",
  "timestamp": "2026-02-07T14:30:00.000Z",
  "data": {
    "id": "clx1234567890",
    "eventType": {
      "id": "clx0987654321",
      "name": "30 Minute Meeting",
      "slug": "30-min",
      "duration": 30
    },
    "startTime": "2026-02-08T10:00:00.000Z",
    "endTime": "2026-02-08T10:30:00.000Z",
    "status": "CONFIRMED",
    "invitee": {
      "name": "John Smith",
      "email": "[email protected]",
      "timezone": "America/New_York"
    },
    "host": {
      "id": "user_abc123",
      "name": "Jane Doe",
      "email": "[email protected]"
    },
    "meetingLink": "https://meet.google.com/abc-defg-hij",
    "location": "Google Meet",
    "notes": "Looking forward to our call!",
    "isRecurring": false,
    "recurringGroupId": null
  }
}

{
  "data": {
    // ... all booking fields ...
    "status": "CANCELLED",
    "cancelReason": "Schedule conflict"
  }
}

{
  "data": {
    // ... all booking fields with NEW times ...
    "startTime": "2026-02-09T14:00:00.000Z",
    "endTime": "2026-02-09T14:30:00.000Z",
    "previousStartTime": "2026-02-08T10:00:00.000Z",
    "previousEndTime": "2026-02-08T10:30:00.000Z"
  }
}

{
  "event": "payment.received",
  "timestamp": "2026-02-07T14:30:00.000Z",
  "data": {
    "bookingId": "clx1234567890",
    "amount": 50.00,
    "currency": "USD",
    "paymentMethod": "stripe",
    "transactionId": "pi_3ABC123DEF456"
  }
}

{
  "event": "contact.created",
  "timestamp": "2026-02-07T14:30:00.000Z",
  "data": {
    "id": "clx1234567890",
    "name": "John Smith",
    "email": "[email protected]",
    "phone": "+14155551234",
    "company": "Acme Inc",
    "notes": null,
    "createdAt": "2026-02-07T14:30:00.000Z",
    "source": "booking"
  }
}

Signature Verification

Each webhook includes an HMAC-SHA256 signature in the X-LinkTime-Signature header. Always verify this signature to ensure the webhook came from LinkTime.

Verification Steps

1. Get the raw request body (as a string, not parsed JSON)
2. Compute HMAC-SHA256 of the body using your webhook secret
3. Compare with the signature header (use timing-safe comparison)

Example: Node.js

import crypto from 'crypto';

function verifyWebhook(payload: string, signature: string, secret: string): boolean {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');

  // Timing-safe comparison
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// In your webhook handler:
app.post('/webhooks/linktime', (req, res) => {
  const signature = req.headers['x-linktime-signature'];
  const isValid = verifyWebhook(req.rawBody, signature, process.env.LINKTIME_WEBHOOK_SECRET);

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  const event = req.body;
  // Process the webhook...

  res.status(200).send('OK');
});

Example: Python

import hmac
import hashlib

def verify_webhook(payload: bytes, signature: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(
        secret.encode(),
        payload,
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected)

# In your Flask handler:
@app.route('/webhooks/linktime', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-LinkTime-Signature')
    is_valid = verify_webhook(request.data, signature, WEBHOOK_SECRET)

    if not is_valid:
        return 'Invalid signature', 401

    event = request.json
    # Process the webhook...

    return 'OK', 200

Retry Behavior

LinkTime automatically retries failed webhook deliveries to ensure reliability. We use a two-phase retry strategy:

What Gets Retried

Best Practices