Webhooks

Let Patreon, Stripe, Shopify, Ko-fi, Gumroad or your own service start an automation, for example giving a role when someone pledges.

Set it up

1. Open Settings, Webhooks (on the phone: More, Webhooks) and add a connection for the service.
2. Step 1: copy your private address and paste it into the service's webhook settings.
3. Step 2: paste the service's secret (Stripe signing secret, Patreon webhook secret, Shopify webhook secret, Ko-fi verification token).
4. Step 3: tick the event types you allow. Nothing is allowed until you tick it, and every other event is refused and written in the log.
5. Step 4: press Send test. It is a real signed call, so it runs the rules that listen for that event.
6. In Automations, make a rule with the trigger Webhook received, pick the connection and the events, and say which value in the call holds the member's Discord id (name it discordId). Start from a recipe if there is one for your service.

What to know

• Qreate does not connect to, log in to or get access to any payment system or store account. It does not process payments and never sees card or bank details. It only receives the notifications (webhooks) your own store sends, checks their signature, and turns the events you allow into roles and messages. The sale happens between you and your buyer on the store. Qreate is not a party to it and holds no money.
• A webhook rule can give or take a role, post a message or send a direct message. It can never ban, time out, delete, lock a channel or call another web address. A role that can run the server, sits above the bot or belongs to another app is never given.
• Stripe: in the Stripe Dashboard open Developers, Webhooks and add an endpoint with your address. Allow checkout.session.completed to give a role and customer.subscription.deleted to take it back. Put the buyer's Discord id in the Payment Link's client_reference_id or in the subscription metadata as discordId.
• Patreon: in the Patreon developer portal open your client, then Webhooks, and create one with your address. Allow members:pledge:create and members:pledge:delete. The member's Discord id comes from their connected Discord account on Patreon.
• Shopify: in your Shopify admin open Settings, Notifications, Webhooks, create one for Order payment in JSON with your address. Allow orders/paid. Ask for the Discord id with a cart note attribute.
• Ko-fi and Gumroad do not sign their calls in a way Qreate can check, so they are marked Weaker: address only. Your private address is the only proof, so keep it secret. Ko-fi has a verification token to paste. For Gumroad you can add a second secret and put ?secret= and the same secret at the end of the address.
• Your own service can call the address with a JSON body and the headers X-Qreate-Timestamp and X-Qreate-Signature (sha256= and the hex HMAC-SHA256 of the timestamp, a dot and the body).
• What protects you: a signature check on every call, a 5 minute replay window, 60 calls a minute per connection and 600 per server, a 64 KB size limit, the event allow-list, optional approval before a rule runs, a pause switch, a secret you can rotate and a connection you can delete.
• Key storage: your provider secret is encrypted before it is stored, with a key that lives on the server and not in the database. A copy of the database without that key cannot read it. It is never shown again after you save it, never written to logs, and never given to Q or to an AI client. It is used only to check that an incoming call is genuine.
• The log keeps the event name, the result and which values were empty, for the last 50 calls and at most 30 days. It does not keep the content of the call.
• Q can explain each step and build the rule for you to approve, but you paste the address and the secret yourself.