Skip to content

Webhooks

Webhooks let you fire HTTP requests at external services when something happens in your Glassy library — a note is saved, a capture lands, a bookmark is filed. Use them to push events into Zapier, n8n, Make, your own server, or anywhere that accepts a POST.

Event types

Event Trigger
note.created A new note is created
note.updated A note is edited
note.deleted A note is permanently deleted
capture.saved A capture is saved via the Companion extension
bookmark.created A bookmark is saved

Per-account webhooks are scoped to the account that registered them — events from other accounts on the same instance are never delivered to your endpoint.

Configuration

  1. Open Settings → Integrations → Webhooks
  2. Click Add endpoint
  3. Paste the destination URL (must be HTTPS in production; HTTP allowed for 127.0.0.1 during development)
  4. Pick the events to subscribe to
  5. Glassy shows a signing secret — copy it now; it is shown only once
  6. Optionally add a label for your own bookkeeping

You can register up to 10 endpoints per account. Each endpoint subscribes to its own event set.

Payload shape

Every webhook is a POST with a JSON body, an HMAC signature header, and a delivery ID:

POST /your/endpoint HTTP/1.1
Content-Type: application/json
X-Glassy-Signature: t=1721667600,v1=4f8a...
X-Glassy-Delivery: dlv_2a4b9c...
User-Agent: Glassy-Webhooks/1.0

{
  "event": "capture.saved",
  "delivery_id": "dlv_2a4b9c...",
  "occurred_at": "2026-07-23T14:20:00Z",
  "account_id": 42,
  "data": {
    "id": 871,
    "type": "video",
    "title": "How vector search works",
    "url": "https://example.com/post",
    "tags": ["search", "ml"],
    "collection": "Reading"
  }
}

The payload for each event includes the full object, not just an ID, so your handler doesn't need to make a follow-up call.

Signature verification

Every webhook request includes an X-Glassy-Signature header. Verify it before trusting the payload:

X-Glassy-Signature: t=<unix-timestamp>,v1=<hex-hmac-sha256>

The signature is HMAC-SHA256(secret, "<timestamp>.<raw-body>"). Verify both that the signature matches and that the timestamp is within 5 minutes of now (replay protection).

const crypto = require("crypto");

function verifyGlassyWebhook(rawBody, header, secret) {
  const [tPart, v1Part] = header.split(",");
  const t = tPart.split("=")[1];
  const v1 = v1Part.split("=")[1];

  const tolerance = 5 * 60; // 5 minutes
  if (Math.abs(Date.now() / 1000 - t) > tolerance) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

Retries

Glassy retries failed deliveries (network errors, 5xx responses, timeouts) with exponential backoff:

Attempt Delay
1 immediate
2 30 seconds
3 5 minutes
4 30 minutes
5 2 hours
6 12 hours

After 6 attempts the delivery is marked failed and dropped. You can replay any delivery from Settings → Integrations → Webhooks → Delivery log.

2xx responses (any status from 200 to 299) are recorded as delivered and never retried. 3xx redirects are followed up to 3 times. 4xx responses are recorded as client_error and not retried (it's your endpoint's bug, not a network problem).

Delivery log

Every attempt is logged with status, response code, latency, and the first 1 KB of the response body. The log keeps the last 1,000 deliveries per endpoint. Filter by event, status, or date range.

Common integrations

  • Zapier / Make / n8n — paste the endpoint URL from your zap; Glassy delivers events as they happen
  • Discord / Slack — set up an incoming webhook in your chat client, then forward Glassy events there
  • GitHub Issues — use a GitHub Action that listens on a webhook URL, opens an issue with the payload
  • Your own server — verify the signature, process the payload, return 200

Limitations

  • Webhooks are per-account, not global. To subscribe to events from multiple accounts, register the endpoint once per account.
  • Webhooks are fire-and-forget from Glassy's perspective. Glassy does not block user actions on webhook delivery.
  • Webhooks do not include voice memo audio or attachment files — only metadata. Pull those via the API if needed.

Learn more

  • MCP Server — read-side integration via the Model Context Protocol
  • Agent Gateway — dispatch tasks to AI agent frameworks