Webhooks
Get an HTTPS request when something happens in your workspace.
Base URLhttps://api.kalle.build/v1AuthBearer kalle_sk_…VersionKalle-Version: 2026-11-01
Create a webhook
Copy the secret from the response. It is only shown once and is used to check that requests come from Appmake.
POST/v1/webhooks
curl https://api.kalle.build/v1/webhooks \
-H "Authorization: Bearer $KALLE_API_KEY" \
-H "Kalle-Version: 2026-11-01" \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com/appmake",
"events": [
"deployment.succeeded",
"deployment.failed",
"project.message.completed",
"domain.verified",
"balance.low"
]
}'Events
project.createdproject.message.completedproject.message.awaiting_approvaldeployment.succeededdeployment.faileddomain.verifieddomain.failedbalance.lowbalance.emptybrowser.task.requires_actionbrowser.task.completedCheck the signature
Each request has an Appmake-Signature header with a timestamp and an HMAC-SHA256 signature of timestamp.body, made with your secret. Reject requests older than five minutes.
verify.ts
import crypto from "node:crypto";
export function verify(body: string, header: string, secret: string) {
const [t, v1] = header.split(",").map((p) => p.split("=")[1]);
const expected = crypto.createHmac("sha256", secret).update(t + "." + body).digest("hex");
const fresh = Date.now() / 1000 - Number(t) < 300;
return fresh && crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}Reply with a 2xx within ten seconds. Failed deliveries are retried with backoff for up to 24 hours.