Send issue events to your webhook

A webhook sends a POST to your own server whenever something happens to an issue Glitchgrab filed — so you can post to Slack, update your own tracker, or notify a customer when their bug is fixed.

Before you start

• You are the org owner.
• An HTTPS endpoint on your server that accepts JSON POSTs.

1. Add a webhook

1. Open Settings in the left sidebar and find Webhooks.

2. Press Add Webhook.
3. Webhook URL — your HTTPS endpoint, e.g. https://example.com/webhooks/glitchgrab.
4. Events — tick what should trigger a POST:
   • Issue Created
   • Issue Updated
   • Issue Closed
   • Developer Commented on GitHub

5. Press Save. You will see Webhook created.
6. The Webhook Secret — copy now, won't be shown again appears. Copy it into your server's environment. You need it to check that requests really come from Glitchgrab.

2. What you receive

Every delivery is a POST with Content-Type: application/json and this shape:

{
  "event": "issue.created",
  "timestamp": "2026-09-12T09:30:00.000Z",
  "data": { }
}

Event	Sent when	Fields in data
issue.created	Glitchgrab opens a GitHub issue from a report	issueUrl, issueNumber, labels, severity, repo
issue.updated	the issue changes on GitHub, including being reopened	issueUrl, title, action (e.g. reopened), glitchgrabIssueId
issue.closed	the issue is closed on GitHub	issueUrl, title, glitchgrabIssueId
issue.commented	a developer comments on the issue on GitHub	issueUrl, title, comment (body, author, authorAvatar, createdAt), glitchgrabIssueId

3. Check the signature

Each request carries X-Glitchgrab-Signature: sha256=<hex> — an HMAC-SHA256 of the raw request body using your webhook secret. Reject anything that does not match.

// Next.js route handler
import { createHmac, timingSafeEqual } from "crypto";

export async function POST(request: Request) {
  const body = await request.text(); // the raw body, before JSON.parse
  const expected =
    "sha256=" + createHmac("sha256", process.env.GLITCHGRAB_WEBHOOK_SECRET!).update(body).digest("hex");
  const received = request.headers.get("x-glitchgrab-signature") ?? "";

  const ok =
    received.length === expected.length &&
    timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  if (!ok) return new Response("bad signature", { status: 401 });

  const { event, data } = JSON.parse(body);
  // ... handle the event
  return new Response("ok");
}

Compute the signature over the body exactly as received. Parsing and re-serialising the JSON first changes the bytes and the check fails.

Delivery rules

• Answer with any 2xx status within 10 seconds.
• A failed or slow delivery is retried once, then dropped. Glitchgrab does not queue deliveries for later — make your endpoint quick, and do slow work after responding.
• Requests come with User-Agent: Glitchgrab-Webhook/1.0.

Remove a webhook

Delete it from the list in Webhooks — Webhook deleted. The Danger zone below can remove all webhooks at once.

Messages

• Please enter a webhook URL.
• Select at least one event.
• Failed to delete webhook — try again.