Every click and scan becomes a signed JSON event at your endpoint within seconds — HMAC signatures your systems can verify, automatic retries with backoff when you're down, and a per-attempt delivery log that proves what happened.
Most link tools treat the scan as a statistic to show you next month. xengo treats it as an event your systems act on now — so the delivery pipeline is engineered like infrastructure: signed payloads, stable event ids, backoff retries, dead-letter queues and an auditable log. If your workflow depends on knowing, it has to be this solid.
Create a webhook (or Zapier / Make / n8n) channel and store its whsec_ signing secret — shown once, like an API key.
Each click or scan lands as a signed JSON event within seconds. Check the signature in a few lines and trigger whatever should happen next.
Endpoint down? We retry with backoff and record every attempt in a per-channel delivery log you can read in the console.
Every delivery to an endpoint you own carries Svix-compatible signature headers — webhook-id, webhook-timestamp and an HMAC-SHA256 webhook-signature keyed on a secret only you hold. Verify with any Svix library or five lines of stdlib code; reject anything that doesn't check out.
A failed delivery is never dropped silently. We re-attempt with increasing backoff — 30 seconds, 2, 10, 15 and 15 minutes — six attempts in all. The event id stays identical on every attempt, so your de-duplication is trivial, and poison messages park on a dead-letter queue instead of vanishing.
Each channel keeps a per-attempt delivery log: when it fired, for which link, which attempt, and the HTTP result. When someone asks "did the alert go out?", you answer with a record, not a shrug.
Real headers, real payload, real verification — nothing you can't check yourself:
POST /hooks/xengo HTTP/1.1
content-type: application/json
webhook-id: evt_9f2c41d8a6b34e07
webhook-timestamp: 1752321600
webhook-signature: v1,K5oZfzN95Z9nWl27qEXs2go1...{
"event": "click",
"source": "qr",
"code": "spring24",
"shortUrl": "go.acme.com/spring24",
"destination": "https://acme.com/offer",
"tags": { "campaign": "spring", "site": "leeds" },
"at": "2026-07-12T11:20:00+00:00",
"referer": null,
"ua": "Mozilla/5.0 (iPhone..."
}import base64, hashlib, hmac
def verify(secret, headers, raw_body: bytes) -> bool:
key = base64.b64decode(secret.split("_", 1)[1])
signed = (f"{headers['webhook-id']}."
f"{headers['webhook-timestamp']}.").encode() + raw_body
want = base64.b64encode(
hmac.new(key, signed, hashlib.sha256).digest()).decode()
return any(hmac.compare_digest(f"v1,{want}", c)
for c in headers["webhook-signature"].split())attempt 1 immediate → 503 logged
attempt 2 +30 seconds → 503 logged
attempt 3 +2 minutes → 503 logged
attempt 4 +10 minutes → 200 logged ✓ delivered
same webhook-id on every attempt — de-dupe and
you will never double-count a click.Events flow through a decoupled queue off the redirect hot path — typically with you in seconds, never blocking the visitor.
Honest semantics: rare duplicates are possible after timeouts — de-dupe on webhook-id and you're exact.
Event, source (link/QR/NFC), code, destination, tags, timestamp, referrer and device — ready to route on.
The same event can also ping Slack, Teams, PagerDuty, Telegram and twenty more — no code required.
Zapier, Make, n8n, Pipedream and Power Automate catch hooks are signed too — real-time, not polling.
Events come from destinations that passed link-safety screening — your automations act on trusted clicks.
Every channel that posts to an endpoint you own: the generic webhook plus Zapier, Make, n8n, Pipedream, Power Automate and Home Assistant. Chat apps like Slack and Teams use their own incoming-webhook URLs and ignore extra headers, so they aren't signed.
We retry with increasing backoff — 30s, 2m, 10m, 15m, 15m — six attempts in total, then record the terminal failure in the delivery log. The webhook-id is identical on every attempt so retries never double-count on your side.
Typically seconds. Events leave the redirect path immediately via a queue, so a slow receiver never slows a visitor. We publish honest latency semantics rather than claiming sub-second magic.
Recompute HMAC-SHA256 over "id.timestamp.body" with the base64 part of your whsec_ secret and compare to the v1 value in webhook-signature — or pass the three headers to any Svix verification library.
Email alerts are on every plan. Webhook and automation channels — with signing, retries and the delivery log — are included from the Pro plan.
Smart URLs, dynamic QR codes and a full API — branded on your own domain, safety-screened, and tracked. Build, re-point and measure it all in one place.
Start free trialBranded short links on a domain you control — editable, screened, and tracked.
Branded QR codes you can re-point any time — never reprint the poster again.
$ curl -X POST api.xengo.io/v1/links { "domain": "go.acme.com", "url": "https://acme.com/…" } → 201 go.acme.com/aB3xK▋
Create and manage links + QR at scale, straight from your own tools.
Create a channel, keep the secret, verify the signature — and let every click and scan drive the systems you already run.