Configure Sign In App webhooks to receive real-time visitor sign-in and sign-out events with HMAC-SHA256 signature verification.
domain: developers.signinenterprise.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Create a webhook subscription for the target site or visitor group, selecting the visitor.signin and visitor.signout event types
Set the destination endpoint URL that will receive the webhook payload
Apply any advanced filters needed to scope which visitors or sites trigger the webhook
On receipt, verify the x-signinapp-webhook-signature header, which contains a timestamp and an HMAC-SHA256 signature, before trusting the payload
Return a 2xx response promptly, since Sign In App retries delivery up to three times on non-2xx responses
Known gotchas
Automatic timeout-based sign-outs do not trigger the visitor.signout event, only manual sign-outs do, so don't rely on the webhook alone to detect timeouts
Each payload includes an idempotency_key - use it to deduplicate retried deliveries rather than processing the same event twice
Signature verification is mandatory to trust payload authenticity, since the endpoint is otherwise a public HTTPS URL
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?