A signed HTTP POST the moment a link is clicked, created, updated or deleted — straight into your warehouse, your Slack, or whatever runs next.
POST https://your-app.com/webhooks/tracklink
X-Tracklink-Event: click.created
X-Tracklink-Delivery: 5a1f8c2e-...
X-Tracklink-Signature: t=1756371262,v1=9c4f...
{
"id": "5a1f8c2e-...",
"event": "click.created",
"created_at": "2026-08-28T09:14:22.104Z",
"data": {
"link_id": "3ddb1d53-...",
"slug": "summer",
"country": "Germany",
"device_type": "Mobile",
"utm_source": "newsletter",
"utm_campaign": "august"
}
}Stream click.created into BigQuery, Snowflake or Postgres and join link data against everything else you measure.
A campaign suddenly getting 10× its usual traffic is worth knowing about in Slack within a minute, not at the end of the week.
A click on a specific link starts an onboarding email, tags a CRM record, or notifies the rep who owns the account.
link.created, link.updated and link.deleted keep your own database in step with Track Link without polling.
Match a click to a session while the visitor is still on the page, rather than reconciling exports later.
Skip the polling loop and the rate limit that comes with it — events arrive when they happen.
HMAC-SHA256 over the timestamp and body. The timestamp is inside the signature, so a captured request cannot be replayed later.
Five attempts with exponential backoff. A 4xx is treated as permanent — retrying a request you deliberately rejected helps nobody.
Fifteen consecutive exhausted deliveries disables the endpoint. A brief outage never trips it, because only an exhausted delivery counts.
Agency and Business. Reading data through the API is available on every plan including free; webhooks are part of the Agency plan at $49/month.
Every delivery carries an X-Tracklink-Signature header: an HMAC-SHA256 over the timestamp and the raw body, keyed with a secret shown once when you create the endpoint. The timestamp is inside the signed material, so a captured request cannot be replayed at you later — reject anything older than about five minutes. There is a copy-pasteable Node example in the docs.
A delivery is retried five times with exponential backoff starting at 10 seconds. A 4xx other than 429 is treated as permanent — you understood the request and rejected it — so it is not retried. After 15 consecutive deliveries exhaust their retries, the endpoint is disabled automatically; a brief outage never trips it, because only an exhausted delivery counts. Re-enable it from the dashboard once it is fixed.
As much as your links get. A busy link can produce thousands of events an hour, and they arrive in bursts rather than a steady trickle. Subscribe to it only if your endpoint can absorb that; if you just want to keep a link mirror in sync, subscribe to the link.* events instead.
Yes. Each endpoint lists its recent failures with the status code and the response body, kept for 7 days. Successful deliveries are not recorded — at click volume that log would be the largest thing we store.
No IP address and no precise coordinates, even where we hold them. A click payload carries the link, coarse geography, device, browser, referrer and UTM values.
Add an endpoint on the Developers page, copy the signing secret, and events start arriving.
See plans