Popular: Create Your First Booking Link Manage Billing
In this article

Webhooks

Send Dlopo booking events to your own HTTPS endpoint so your internal tools and automations can react without polling. Webhooks are included on Free, Pro, and Teams plans and are configured from Integrations.

Before You Begin

You need:
  • a public HTTPS endpoint that accepts JSON POST requests;
  • access to configure the receiving service with a signing secret.
Dlopo rejects HTTP URLs, URL credentials, localhost, private-network destinations, and hostnames that cannot be resolved. The destination is checked again before each delivery. Redirects are not followed. You can configure one webhook endpoint per workspace.
Webhook payloads can include host and guest names and email addresses, meeting links, notes, booking source, and custom question responses. Send them only to infrastructure your organization controls and apply your normal access and retention policies.

Configure Webhooks

  1. Open Integrations.
  2. Find Webhooks under All or Automation.
  3. Open the integration.
  4. Enter your Endpoint URL.
  5. Select at least one event:
    • booking.created — a booking was confirmed;
    • booking.approved — a host approved a pending booking request;
    • booking.declined — a host declined a pending booking request;
    • booking.rescheduled — an existing booking moved to a new time;
    • booking.cancelled — a host or guest cancelled a booking;
    • booking.reminder_sent — a scheduled reminder email was sent to the guest.
  6. Select Add Endpoint.
  7. Under Signing Secret, copy the full secret and store it securely in your receiving service.
Dlopo shows the full signing secret only after the endpoint is created or the secret is rotated. After you reopen the panel, only a masked hint is shown. To change the URL or selected events, update the fields and select Save Changes.

Understand the Request

Each selected event sends a JSON request with a stable event ID, event type, API version, creation timestamp, and booking data. Booking data includes the booking ID, status, start and end time, host and guest context, booking-link title and slug, meeting type and URL, responses, notes, and booking source when available.
{
  "id": "evt_7d846b0b5b9e420f87493f9fca6eb86b",
  "type": "booking.created",
  "api_version": "2026-07-22",
  "created_at": "2026-07-22T12:00:00.000Z",
  "data": {
    "booking": {
      "id": "6880d17bd0ac48a4a64780f1",
      "status": "CONFIRMED",
      "start": "2026-07-24T09:00:00.000Z",
      "end": "2026-07-24T09:30:00.000Z",
      "guest": { "name": "Alex Guest", "email": "alex@example.com" }
    }
  }
}
Unavailable scalar fields are sent as null. If no custom responses were collected, responses is an empty array.
Requests include Dlopo-Event, Dlopo-Event-Id, Dlopo-Webhook-Version, Dlopo-Webhook-Timestamp, and Dlopo-Webhook-Signature headers. Return any 2xx response within five seconds to acknowledge the event.

Verify Each Request

The Dlopo-Webhook-Signature header has this format:
t=1784721600,v1=signature
To verify it:
  1. Read the raw request body before parsing JSON.
  2. Combine the timestamp, a period, and the raw body: {timestamp}.{rawBody}.
  3. Create an HMAC-SHA256 digest using the endpoint signing secret.
  4. Compare the digest with v1 using a timing-safe comparison.
  5. Reject timestamps outside a short tolerance, such as five minutes.
Never log the signing secret or include it in client-side code. Select Rotate Signing Secret if the secret may have been exposed. Rotation immediately invalidates the previous secret, so update the receiver before the next booking event.

Handle Retries and Duplicate Events

Webhook failures never cancel, delay, or roll back the booking. Dlopo retries network failures and HTTP 408, 425, 429, and 5xx responses. A delivery can make up to three automatic attempts. Other 4xx responses and redirects are recorded as failures after the first attempt.
Automatic and manual retries preserve the original event ID. Store processed event IDs in your receiver so repeated attempts do not create duplicate work.

Review Webhooks Logs

Once an endpoint is configured, select View Logs beside Webhooks in Integrations. Webhooks Logs shows the latest 25 delivery records with the event type, event ID, timestamp, attempt count, HTTP status when available, and an error for failed requests. Logs are retained for 30 days.
After correcting the receiver, select Retry on a failed delivery. Retry is available only while delivery is enabled.
If delivery fails, confirm that the endpoint is publicly reachable over HTTPS, accepts JSON POST requests, and responds within five seconds. Then confirm that signature verification uses the raw body and the current secret.

Pause or Remove Webhooks

Use the Webhooks switch in Integrations to pause or resume new deliveries. Pausing keeps the endpoint, signing secret, and existing logs.
To remove Webhooks completely:
  1. Open Webhooks in Integrations.
  2. Select Remove Endpoint in the panel header.
  3. Confirm Remove Endpoint.
Removing the endpoint permanently deletes its signing secret and delivery logs. Existing bookings are unaffected.

Did this answer your question?

Up Next
Last Updated 23 July 2026
Google Meet

Google Meet is a simple choice when you want every booking to have its own video call. Connect your Google...