Developer integration
Webhooks + CaptiFi
Get guest sign-ups pushed to your own systems the second they happen, with signed payloads, automatic retries and a delivery log. Included on Growth and above.
Get guest sign-ups pushed to your own systems the second they happen, with signed payloads, automatic retries and a delivery log. Included on Growth and above.
Webhooks turn CaptiFi into an event source for the rest of your stack. Instead of asking the API what changed, you give CaptiFi an HTTPS URL and CaptiFi posts to it the moment something happens: a guest signs up on your WiFi for the first time, or a guest who has been before connects again. Your booking system, CRM or automation tool knows about it a second later.
Add up to five endpoints, which is handy for pointing the same events at a live system and a staging one, and tick the events each endpoint should receive. Every request carries an HMAC SHA-256 signature over the raw body, along with the event name and a delivery id, so you can prove a payload came from CaptiFi before you trust it and treat a repeat of the same id as one event.
Delivery is built for the real world. A failed attempt retries automatically with backoff, every attempt is recorded for 30 days with the response code and how long your server took, and an endpoint that keeps failing is switched off rather than hammered forever. You can fire a test event while you build, and rotate a signing secret whenever you need to. Webhook payloads contain guest personal data, so CaptiFi will only send them over HTTPS, and once a copy reaches your systems your own retention and deletion obligations apply to it.
A guest signs in and your system hears about it a second later, so welcome journeys, CRM records and ops alerts fire on arrival instead of on your next scheduled poll.
Every request carries an HMAC SHA-256 signature over the raw body plus a timestamp, so you can reject anything that is not genuinely from CaptiFi and anything replayed later.
Failures retry automatically with backoff, and every attempt is logged for 30 days with the response code and duration, which answers "did CaptiFi send it, or did my server reject it?" in seconds.
Point the same events at production and a test environment, switch an endpoint off without deleting it, send a test event while you build, and rotate a signing secret when your security policy says so.
Open Webhooks in your CaptiFi dashboard, paste the HTTPS URL that should receive events, and tick the events you want. The URL must be HTTPS: payloads contain guest personal data and are never sent unencrypted.
Compute an HMAC SHA-256 of the timestamp and the raw request body using your endpoint signing secret, compare it in constant time with the X-CaptiFi-Signature header, and reject anything older than five minutes. Always verify before you trust a payload.
Fire a test event from the dashboard to confirm your handler accepts it, then switch the endpoint on. Answer with any 2xx as soon as you have accepted the event and do the slow work afterwards.
Each attempt is listed with the event, attempt number, response code and duration, kept for 30 days. De-duplicate on the event id so a retry is never processed twice.
A hotel pushes every new WiFi sign-up into its PMS-linked CRM on arrival, so the front desk sees a returning guest flagged before they reach the counter.
A guest.returned event triggers an internal alert for regulars, letting the floor team greet frequent diners by name without anyone watching a dashboard.
New sign-ups post straight into a low-code automation tool, which adds the contact to an email platform, tags the store branch and starts a first-visit voucher sequence.
30-day free trial. Cancel anytime.