API Reference

Webhooks

GitHub push, PR close, snapshot bump events.

flagctl emits webhooks for the events you care about: GitHub push arrivals, PR close (which auto-revokes preview overrides), and snapshot bumps (which downstream SDKs should refresh on).

Configure

From the dashboard: Settings → Webhooks → Add endpoint. Or via the CLI:

flagctl webhooks add \
--url https://example.com/hooks/flagctl \
--events snapshot.bumped,pr.closed

Events

Event	Payload
`snapshot.bumped`	`{ project, env, snapshotId, prevSnapshotId }`
`pr.closed`	`{ project, pr, merged }`
`flag.applied`	`{ project, flag, env, diff }`

Signing

Every webhook carries X-Flagctl-Signature: t=<ts>,v1=<hmac>. Verify by HMAC-SHA256 over <ts>.<body> using your endpoint's signing secret.

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody: string, header: string, secret: string) {
const parts = Object.fromEntries(header.split(',').map(p => p.split('=')));
const expected = createHmac('sha256', secret)
  .update(`${parts.t}.${rawBody}`)
  .digest('hex');
return timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}