Webhooks

Last updated: 13 October 2026
A webhook tells one of your other tools that something happened in Peas & Pans. When you add a client or publish a meal plan, we send a short message to an address you give us. Zapier, Make, n8n and most mailing-list and CRM tools can receive it and act on it: add the client to your mailing list, tell your assistant, send your client a text.
Webhooks are on every plan.

Add a webhook

  1. In your other tool, make an address that receives webhooks. In Zapier it is the trigger "Webhooks by Zapier", "Catch Hook". In Make it is "Custom webhook".
  2. In Peas & Pans, go to Settings, then Webhooks, and choose Add a webhook.
  3. Paste the address and choose what to be told about.
  4. Choose Send a test. Your other tool shows the test, and Peas & Pans shows that it arrived.
You can have three webhooks. The address must start with https://.

What we send

Each message is JSON with the same four parts: an id, a type, the time it was created, and data.
When a client is added (client.created):
json
{
  "id": "evt_01K7ABCDEFGHJKMNPQRSTVWXYZ",
  "type": "client.created",
  "created": "2026-10-13T10:02:11.000Z",
  "data": {
    "client": {
      "id": "01K7ABCDEFGHJKMNPQRSTVWXY0",
      "name": "Alex Rivers",
      "email": "alex@example.com",
      "createdAt": "2026-10-13T10:02:11.000Z",
      "source": "app",
      "url": "https://app.peasandpans.com/clients/01K7ABCDEFGHJKMNPQRSTVWXY0"
    }
  }
}
source says where the client came from: app, import (a spreadsheet), request (a request on your page that you accepted) or connector (an AI agent you connected). email is null when you did not give one.
When a meal plan is published (plan.published):
json
{
  "id": "evt_01K7ABCDEFGHJKMNPQRSTVWXZ1",
  "type": "plan.published",
  "created": "2026-10-13T10:05:40.000Z",
  "data": {
    "plan": {
      "id": "01K7ABCDEFGHJKMNPQRSTVWXY2",
      "title": "Week one",
      "dayCount": 7,
      "publishedAt": "2026-10-13T10:05:40.000Z",
      "url": "https://app.peasandpans.com/plans/01K7ABCDEFGHJKMNPQRSTVWXY2"
    },
    "client": {
      "id": "01K7ABCDEFGHJKMNPQRSTVWXY0",
      "name": "Alex Rivers",
      "email": "alex@example.com",
      "pageUrl": "https://peasandpans.com/c/4f7k2m9p"
    }
  }
}
pageUrl is your client's own link. It opens their plans for anyone who has it. We send it to the address you typed and nowhere else, so use an address you trust. It is null when the client has no link yet. In Recent deliveries we show the message with this link left out.
"Send a test" sends ping, which has a message in data and nothing from your account.

What we never send

No health answers. A webhook never holds a client's intake answers, weight, targets, allergies, food rules or your notes about them.

Check that a message is from us

Each webhook has a signing secret, which starts with whsec_. It is in Settings, Webhooks, Manage. Every message has three headers:
  • webhook-id: the same as id in the message.
  • webhook-timestamp: the time we sent it, in seconds.
  • webhook-signature: v1, and then a signature.
This is the Standard Webhooks format, and there is a library for most languages that checks it for you. To check it yourself:
  1. Take the part of the secret after whsec_ and decode it from base64. That is the key.
  2. Join the id, the timestamp and the body exactly as received, with a full stop between them: id.timestamp.body.
  3. Compute HMAC-SHA-256 of that text with the key, and encode the result in base64.
  4. Compare it with the part of webhook-signature after v1,. Refuse the message if they differ, or if the timestamp is more than five minutes old.
Compare the two signatures in constant time (for example crypto.timingSafeEqual in Node or hmac.compare_digest in Python), not with ==. A plain comparison can tell an attacker how much of a guess was right.
If a secret may have been seen by someone else, choose Make a new secret and put the new one in your other tool.

When a message does not arrive

Your tool must answer with a status from 200 to 299 within 10 seconds. If it does not, we try again after 15 minutes, 1 hour, 4 hours, 12 hours and 24 hours: six tries in about two days. We do not follow redirects.
A message can arrive more than once. The webhook-id is the same each time, so keep the ids you have handled and ignore a repeat.
Recent deliveries shows the last 50 messages for 30 days: what was sent, what your tool answered, and when the next try is. Send again sends one now.
If nothing arrives for 5 days, we switch the webhook off and email you. Check the address in your other tool, then switch the webhook on again.
You can send 500 messages a day. "Send a test" and "Send again" count.

Remove a webhook

Go to Settings, then Webhooks, choose Manage, then Remove webhook. Nothing more is sent, and the record of what was sent is deleted.