Feature
SMLLR Webhooks: Real-Time QR & Scan Events, Pushed To You.
Register a URL, a Slack channel, or a Zapier trigger, and SMLLR posts a signed JSON payload the instant a QR is created, scanned, or a redirect rule fires — real time, no polling.
Six Events, Delivered as They Happen
Register an HTTPS endpoint (or a Slack channel) under Settings → Webhooks & Slack (Pro plan and above) and SMLLR POSTs a signed JSON payload to it the moment a subscribed event happens — no polling, no delay. This complements the REST API and MCP server, which are both pull-based; webhooks are the push-based counterpart for the same account analytics.
- Event types: scan.created, qr.created, qr.updated, qr.scan_limit_reached, qr.scheduled_redirect_fired, qr.device_redirect_matched
- Each endpoint picks which events it subscribes to — new endpoints default to everything except the two highest-volume, per-scan redirect events
- scan.created payload: qrCodeId, qrCodeName, campaignId, scanId, scannedAt, device, os, browser, country, region, city, targetUrl
- Delivery is account-wide — every enabled endpoint fires on every matching event across the account (no per-QR scoping in v1)
- Up to 10 endpoints per account, generic and Slack combined
- HTTPS-only endpoint URLs
No Lead Data, Ever
Every event payload is deliberately minimal — the same aggregated scan/QR fields the REST API and MCP server already expose, never the full internal scan record (which also holds IP address, precise GPS, and fraud-detection signals), and never anything from Lead Hub. A webhook payload can never carry a scanner's name, email, phone number, or consent record, by design — not just by configuration.
Slack and Zapier, on the Same Infrastructure
A Slack endpoint is just a Slack Incoming Webhook URL — paste it in and SMLLR posts a formatted message to that channel, no separate app install or OAuth approval needed. Zapier works the same way in reverse: point Zapier's built-in "Webhooks by Zapier → Catch Hook" trigger at a generic SMLLR endpoint URL to connect to 6,000+ apps, no SMLLR app in the Zapier directory required.
Verifying Deliveries
Every generic-endpoint delivery includes an X-Smllr-Signature header (HMAC-SHA256 over the timestamp and raw request body, using the secret shown once when you create the endpoint) and an X-Smllr-Timestamp header. Recompute the signature on your end and compare — this confirms the payload actually came from SMLLR and wasn't replayed or tampered with in transit. Slack endpoints have no signature — the Incoming Webhook URL itself is the secret.
Delivery and Retries
Failed deliveries (endpoint down, non-2xx response, timeout) are automatically retried; deliveries that keep failing land in a dead-letter queue after 5 attempts. Every attempt — success or failure — is logged and visible under Settings → Webhooks & Slack for up to 90 days, including HTTP status and response time, so you can debug a misconfigured endpoint without guessing.
Frequently Asked Questions
Does SMLLR support outbound webhooks?
Yes, on the Pro plan and above. Register an HTTPS URL under Settings → Webhooks & Slack and SMLLR POSTs a signed JSON payload to it for each event you subscribe to.
What events can trigger a webhook?
Six event types: scan.created, qr.created, qr.updated, qr.scan_limit_reached, qr.scheduled_redirect_fired, and qr.device_redirect_matched. You pick which ones each endpoint receives.
What data is in a webhook payload?
Aggregated QR/scan analytics only: QR code, campaign, scan ID, timestamp, device, OS, browser, and country/region/city, depending on the event. Never IP address, precise GPS, or any Lead Hub contact data.
Does SMLLR integrate with Slack?
Yes — create a Slack Incoming Webhook URL from your workspace and paste it into Settings → Webhooks & Slack as a Slack-type endpoint. No OAuth or app install approval required.
Does SMLLR integrate with Zapier?
Yes — point Zapier's built-in "Webhooks by Zapier" trigger (Catch Hook) at a generic SMLLR webhook endpoint URL. SMLLR doesn't require a separate app listing in the Zapier directory for this to work.
How do I verify a webhook came from SMLLR?
Generic endpoints include an X-Smllr-Signature header — an HMAC-SHA256 signature over the timestamp and request body, computed with the secret shown once when you create the endpoint. Recompute and compare it on your end. Slack endpoints have no signature; the Incoming Webhook URL itself is the secret.
What happens if my endpoint is down?
SMLLR retries failed deliveries automatically. After 5 failed attempts, that delivery moves to a dead-letter queue rather than retrying forever. Every attempt is logged in Settings → Webhooks & Slack.
Can I scope a webhook to just one QR code?
Not in the current version — every enabled endpoint fires on every matching event across the account. Per-QR scoping is a natural future extension, not built yet.
What plan do I need for webhooks?
Pro plan and above — the same requirement covers webhooks, Slack, and Zapier.
Unlock Every Feature
Start free with 3 static QR codes. Upgrade anytime to unlock dynamic QR codes, more codes, and scan analytics.