An honest API for creators.

A few things creators build with these events:

• CRM sync. Subscribe to student.created and enrollment.created — every new student is auto-pushed to HubSpot / Zoho / a Google Sheet, with their course list tagged.
• Slack / Discord pings. Subscribe to order.paid — your team gets a Slack message every time someone buys, including the product name and customer email.
• Accounting export. Subscribe to order.paid + order.refunded — your bookkeeping tool (Tally / QuickBooks / Zoho Books) gets each transaction with gross / gateway-fee / net columns pre-split.
• Auto-issue downloads. Subscribe to order.paid for a digital product — your serverless function generates a watermarked PDF and emails it to the buyer in seconds.
• Recording archival. Subscribe to recording.ready — when a live class finishes, your script copies the file to your own S3 bucket for long-term storage.

Webhooks are the right tool when you need to react in near-real-time. For batch / periodic sync, prefer the REST API above with cursor pagination.

Verifying our signature (Node.js example)

import crypto from 'crypto'

const SECRET = process.env.TBC_WEBHOOK_SECRET!
app.post('/webhooks/tbc', express.raw({ type: '*/*' }), (req, res) => {
  const sig = req.header('X-TBC-Signature') || ''
  // X-TBC-Signature: t=<unix>,v1=<hex>
  const parts = Object.fromEntries(sig.split(',').map(p => p.split('=')))
  const ts = Number(parts.t)
  if (Math.abs(Date.now() / 1000 - ts) > 300) return res.status(400).end() // 5-min replay window
  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(`${ts}.${req.body.toString('utf8')}`)
    .digest('hex')
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1))) {
    return res.status(401).end()
  }
  // Trust the body now — your job to dedupe on body.id
  const event = JSON.parse(req.body.toString('utf8'))
  /* … */
  res.json({ ok: true })
})

Use express.raw (or your framework's equivalent) so the body bytes match what we signed. Parsing JSON BEFORE verifying will silently change whitespace and break the HMAC.