Skip to main content
POST https://api.craftkit.dev/v1/hooks/:token
Triggers a render from any external system that can POST JSON. The webhook URL and HMAC secret are auto-generated when a template is created. The body is the variable data, flat — no { data: … } wrapper. Inbound renders share the rendering pipeline with POST /v1/templates/:slug/render: same Zod validation, versioning, dashboard row, and outgoing webhooks.

​
Authorization

Inbound webhooks are not authenticated with a project API key. The per-template token in the URL identifies the template; an optional HMAC signature proves the payload’s integrity.
​
string
Optional. Hex-encoded HMAC-SHA256 of the raw request body, keyed by the template’s inbound secret. When present it is verified; when absent the request is accepted (toggle enforcement per template in the dashboard for production traffic).

​
Path parameters

​
string
required
The per-template inbound token from the Use this template → Inbound webhook panel. Identifies and authenticates the target template.

​
Body

The body is the flat variable data — the manifest keys for the target template, with no envelope. Scalars nest by dot-path; loops are keyed by their dot-free top-level key. Keys absent from the manifest are stripped. Invalid payloads return 400 invalid_input_data with the offending fields in issues.fieldErrors.
​
object
required

​
Response

202 when a render is queued.
​
string
Render id (UUIDv7).
​
string
Always queued on accept.
​
string
GET this with your project bearer token to poll the render.

​
Errors

cURL
202