Glossary · Mesurer proprement
Webhook
A webhook is a message a service sends automatically to an address you gave it, as soon as an event happens on its side. It is the opposite of polling: instead of asking whether there is anything new, you get told.
Cookies, consentement, serveur : mesurer la campagne sans pister la personne. The forty terms of the trade
What it is for
It connects tools that know nothing of each other. A payment taken at a provider becomes an attributed sale at your end, with nobody retyping anything, within the second. It is what makes a tool pluggable into any service able to receive structured text.
How it is secured
By a signature, never by keeping the address secret. A receiving address is public by nature: it travels through settings, logs and screenshots. It is the message's signature that proves the sender, and a message without a valid signature must write nothing at all.
The classic mistake
Assuming a hard-to-guess address is enough. It protects nothing: anyone can then declare a $10,000 sale at your end, and the client's report becomes false with no alert firing.
A webhook that holds, end to end
- The eventA payment is taken at the provider.
- The sendThe message leaves for your address, signed by the sender.
- The checkInvalid signature, nothing is written. That is what authorises, not the address.
- The writeThe sale is recorded once — the key is carried by the payment, not the message.
Four beats, with two safeguards in the last two. Skipping either makes the report forgeable.
What Subtraq does with it
Both ways. Inbound, a message without a valid signature writes nothing — the key in the address authorises nothing, the signature does. Outbound, every conversion is signed before it leaves, the address must be https, and local or private addresses are refused.
Read next
Un terme seul ne sert à rien. Voici ceux qui le rendent utilisable.
Deduplication
Read the definition →Server-side conversion API
Read the definition →Integrations
Open the page →Connecting Zapier to Subtraq
Open the page →Subtraq for developers
Open the page →« Webhook », une fois posé sur de vraies ventes
Measuring a campaign does not require tracking a person. What the tool collects, what it refuses to collect, and who is responsible for what: the security page says it plainly.
Read the security page