Send issue and call events to your webhook

A webhook sends a POST to your own server whenever something happens to an issue Glitchgrab filed or a call it recorded — so you can post to Slack, update your own tracker, or notify a customer when their bug is fixed.

Before you start

• You are the org owner.
• An HTTPS endpoint on your server that accepts JSON POSTs.

1. Add a webhook

1. Open Settings in the left sidebar and find Webhooks.

2. Press Add Webhook.
3. Webhook URL — your HTTPS endpoint, e.g. https://example.com/webhooks/glitchgrab.
4. Project — leave it on All projects to get every project's events, or pick one project so a product's own backend gets only that project's issues and calls.
5. Events — tick what should trigger a POST:
   • Issue Created
   • Issue Updated
   • Issue Closed
   • Developer Commented on GitHub
   • Phone Call Ended
   • Call Recording Ready
   • Call Summary Ready

6. Press Save. You will see Webhook created.
7. The Webhook Secret — copy now, won't be shown again appears. Copy it into your server's environment. You need it to check that requests really come from Glitchgrab.

The list shows each webhook's project (or all projects) next to its events.

2. What you receive

Every delivery is a POST with Content-Type: application/json and this shape:

{
  "event": "issue.created",
  "timestamp": "2026-09-12T09:30:00.000Z",
  "data": { }
}

Event	Sent when	Fields in data
issue.created	Glitchgrab opens a GitHub issue from a report	issueUrl, issueNumber, labels, severity, repo
issue.updated	the issue changes on GitHub, including being reopened	issueUrl, title, action (e.g. reopened), glitchgrabIssueId
issue.closed	the issue is closed on GitHub	issueUrl, title, glitchgrabIssueId
issue.commented	a developer comments on the issue on GitHub	issueUrl, title, comment (body, author, authorAvatar, createdAt), glitchgrabIssueId
call.completed	a phone call on one of your project's numbers ends, answered or not	callId, repoId, lineId, direction, peer, status, durationSec, hangupCause
call.recording_ready	a phone call's recording is stored	callId, repoId, direction, peer, durationSec
call.summary_ready	any recorded call (phone or Meet) gets its summary	callId, repoId, recorder, title, summary

Call events never carry audio links. Fetch the call itself with the project's server key and getCall from glitchgrab/server.

3. Check the signature

Each request carries X-Glitchgrab-Signature: sha256=<hex> — an HMAC-SHA256 of the raw request body using your webhook secret. Reject anything that does not match.

// Next.js route handler
import { createHmac, timingSafeEqual } from "crypto";

export async function POST(request: Request) {
  const body = await request.text(); // the raw body, before JSON.parse
  const expected =
    "sha256=" + createHmac("sha256", process.env.GLITCHGRAB_WEBHOOK_SECRET!).update(body).digest("hex");
  const received = request.headers.get("x-glitchgrab-signature") ?? "";

  const ok =
    received.length === expected.length &&
    timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  if (!ok) return new Response("bad signature", { status: 401 });

  const { event, data } = JSON.parse(body);
  // ... handle the event
  return new Response("ok");
}

Compute the signature over the body exactly as received. Parsing and re-serialising the JSON first changes the bytes and the check fails.

Delivery rules

• Answer with any 2xx status within 10 seconds.
• A failed or slow delivery is retried once, then dropped. Glitchgrab does not queue deliveries for later — make your endpoint quick, and do slow work after responding.
• Requests come with User-Agent: Glitchgrab-Webhook/1.0.

Remove a webhook

Delete it from the list in Webhooks — Webhook deleted. The Danger zone below can remove all webhooks at once.

Messages

• Please enter a webhook URL.
• Select at least one event.
• Pick a project you own — the project chosen is not one you own.
• Failed to delete webhook — try again.