Register your webhook endpoint

Point socially.run at an https URL and start receiving events there. The answer carries the signing secret ONCE, when it is minted: keep it. Every delivery is signed with it in the x-socially-signature header (t=<unix>,v1=<hmac-sha256 of "<t>.<body>">), and that signature is how you know a request is really from us. Calling this again updates the URL or the subscription and keeps the same secret unless you ask to rotate it. Saving also re-enables an endpoint we had disabled. Up to 5 attempts for no answer, 5xx, 408, 425 or 429, with gaps of 30, 60, 120 and 240 seconds. A longer Retry-After extends the gap, capped at one hour. Other 4xx and all redirects are final. Free.