Every event, signed and pushed. The instant it happens.
Subscribe a REST endpoint or point Zapier's "Catch Hook" at Qanary (native app in
private beta) and get promoter.approved, commission.created,
payout.paid, and conversion.created the moment they occur —
signed, so you can verify every payload before you trust it.
if your endpoint doesn't return a 200, we retry it. you don't build a queue.
- Free plan, no card required
- Zapier private beta, or Webhooks by Zapier today
- Signed & retried, tested every commit
A cron job isn't an integration.
Without webhooks, "stay in sync" means a script that polls the API on a timer, hoping something changed since the last run — plus a fresh bespoke script for every downstream tool you want to notify: your ESP today, Slack tomorrow. Here's the difference one signed event stream makes:
Poll-and-hope integrations
A cron job hits the API every few minutes and diffs the result — minutes of lag, wasted requests, and a bespoke script per tool you want to notify.
Qanary
One signed event stream, pushed the instant something happens. Wire it to Zapier's Catch Hook (or the native app, private beta), or verify the signature yourself and forward it anywhere.
From event to inbox. Three steps.
1. Subscribe an endpoint — POST /api/v1/webhook_endpoints
with your API key and the events you want.
2. Qanary pushes the event — a signed POST to your URL the moment it happens, retried if your endpoint doesn't answer with a 200.
3. You verify, then act — check the HMAC-SHA256 signature, then hand the event to Zapier, your ESP, or your own code.
Three ways in. One signed stream.
Zapier, private beta — or Catch Hook today
Trigger a Zap on Promoter Approved without writing code. While the native Qanary app is in private beta, Webhooks by Zapier's "Catch Hook" subscribes the same REST hook in the meantime.
Four event types, one endpoint
Subscribe to promoter.approved, commission.created,
payout.paid, and conversion.created with a single
POST /api/v1/webhook_endpoints call; unsubscribe any endpoint with a
DELETE.
Signed, retried, and testable
Every payload carries a Qanary-Signature header you verify with
HMAC-SHA256 — and a Send test event button lets you check the wiring
before a real affiliate is on the line.
Four ways teams put events to work.
Slack alert on a new top affiliate
A Zap on promoter.approved posts straight to your team channel — no
one has to remember to check the dashboard for new joins.
Syncing conversions into your warehouse
Forward conversion.created to your own pipeline in real time instead
of a nightly job that polls the API and diffs the result.
Confirming wiring before going live
Press Send test event and watch a real payload hit your endpoint — debug signature verification before a real affiliate is on the line.
A deploy mid-flight
Your endpoint misses a 200 while redeploying — Qanary retries delivery automatically, so the event isn't just lost.
See it side by side.
| Capability | Poll-and-hope integrations | Qanary |
|---|---|---|
| Delivery model | Scheduled polling | Pushed the instant it happens |
| Native integration required per tool | Yes, one per tool | No, one webhook via Zapier |
| Payload signed & verifiable | No | Yes, HMAC-SHA256 + timestamp |
| Failed delivery retried automatically | Varies by vendor | Yes |
| Test before going live | Rare | Yes, Send test event button |
| Event catalog | Ad hoc, undocumented | 4 documented events, same shape as the REST API |
| Price tied to your affiliate-driven revenue | Often, past a tier | Never — flat, event-based |
"Poll-and-hope integrations" describes any sync built by scheduling a job against an API and diffing the result, with a separate script per downstream tool — the common fallback when a platform has no webhooks and no Zapier app. See the full pricing for how Qanary's usage-based plans compare.
Because the event reaches you before a cron job would even check.
- Signed, not just sent. An HMAC-SHA256 signature over the timestamp and raw body — verify it yourself with a constant-time compare before you trust a payload came from Qanary.
- Retried automatically. A 200 is all we need — miss it, and Qanary retries delivery, so a deploy mid-flight doesn't cost you an event.
- Test before it's live. Press Send test event and watch a real payload hit your endpoint — debug signature verification before a real affiliate is on the line.
- One stream, any tool. The same signed event reaches Zapier, your own code, and anything else you point it at — no bespoke script per downstream tool.
- Ships on every plan. Webhook endpoints, all four event types, and the Zapier recipe are included from Free — no add-on module, no "available on Enterprise."
Webhooks are the wiring, not the destination — see the ESP integration guide for the "affiliate approved → welcome email" recipe end to end, or the full mechanics in the REST API reference.
Fair questions.
Is the native Zapier app available now?
It's in private beta. Until you're invited, use Webhooks by Zapier's "Catch Hook"
trigger — it subscribes the same REST hook behind the scenes via
POST /api/v1/webhook_endpoints, so the rest of the Zap works identically
once you switch over.
How do I confirm a webhook actually came from Qanary?
Every request carries a Qanary-Signature: t=<unix>,v1=<hex>
header. Compute HMAC-SHA256(secret, "t.raw_body") and compare it to
v1 with a constant-time comparison, and reject requests where
t is stale. The full recipe, including a roughly 20-line receiver, is in
the ESP integration guide.
What events can I subscribe to, and what's in the payload?
promoter.approved, commission.created,
payout.paid, and conversion.created today. Each payload uses
the same serializer as the REST API — promoter.approved, for example,
carries the same fields GET /api/v1/affiliates/:id returns, so what your
Zap sees matches what you'd fetch directly.
I lost my signing secret — can I see it again?
No — POST /api/v1/webhook_endpoints returns it exactly once, at
creation. If you've lost it, delete the endpoint and create a new one; the new
response includes a fresh secret.
Everything you need to subscribe an endpoint.
Stop polling. Start listening.
Subscribe an endpoint tonight — signed events, automatic retries, and a test button, free on every plan.
Join the waitlist