← All documentation

Inbound LMS webhooks

Inbound LMS endpoints are available on Starter and Pro. Each endpoint selects a published template and maps JSON paths to certificate fields.

Create an endpoint

The endpoint URL is shown once. Signed mode also shows a signing secret once. Treat both as credentials and regenerate them after exposure.

Field mapping

Every endpoint requires recipient.name. SMTP-enabled endpoints also require recipient.email. Map a stable completion identifier to external_id for duplicate protection.

Signed requests

Send X-CertKit-Signature: t=TIMESTAMP,v1=HEX_HMAC. Compute lowercase HMAC-SHA256 over timestamp.rawBody. Timestamps must be within five minutes.

const signed = createHmac("sha256", signingSecret)
  .update(`${timestamp}.${rawJsonBody}`)
  .digest("hex");

Replay and processing

Known endpoints reject stale or invalid signatures before queuing. Duplicate bodies within the replay window do not issue twice. Accepted receipts are durable and processed asynchronously.

Diagnostics

The settings page shows safe excerpts for recent rejected attempts. Secrets and signature headers are redacted. Unknown random endpoint tokens leave no activity record.