Build

Routing webhooks

Receive sales, support, and handoff alerts at a customer-configured HTTPS destination.

Do not confuse alerts with CRM records

Routing webhooks deliver operational alerts selected by the customer in Routing. They do not use CRM field mappings and they do not use the CRM Webhook signature format.

Routing webhook	CRM Webhook
Visitor alerts and handoff moments	Mapped CRM record operations
Signature is HMAC of exact JSON body	Signature includes timestamp and delivery ID
Configured as a Custom app destination	Configured under Integrations
Return any 2xx after acceptance	Return the documented operation response

Receive and verify an alert

Concierge sends a JSON object containing event, siteId, occurredAt, and event-specific fields. If the customer configured a signing secret, compare X-Concierge-Signature with the lowercase HMAC-SHA256 hex of the exact raw body.

Header	Purpose
X-Concierge-Event	Alert type selected by the customer
X-Concierge-Site-Id	Site that owns the alert
X-Concierge-Delivery-Id	Stable identity for receiver deduplication
X-Concierge-Signature	Optional raw-body HMAC-SHA256 hex

Example alert

{
  "event": "specialist_requested",
  "siteId": "site_...",
  "occurredAt": "2026-07-29T20:00:00.000Z",
  "conversationId": "64f...",
  "visitorName": "Taylor",
  "pageUrl": "https://customer.example.com/pricing"
}

Node signature check

import { createHmac, timingSafeEqual } from "node:crypto";

const expected = createHmac("sha256", process.env.CONCIERGE_ROUTING_SECRET)
  .update(rawBody)
  .digest("hex");
const supplied = request.headers["x-concierge-signature"] || "";
const valid = /^[a-f0-9]{64}$/i.test(supplied) && timingSafeEqual(
  Buffer.from(expected, "hex"),
  Buffer.from(supplied, "hex")
);

Test the customer route

The customer creates the Custom app route in Concierge and selects the moments it should receive. Test with a non-production receiver before enabling live visitor traffic.

Create an HTTPS endpoint and optional signing secret.
In the site, open Routing and add the Custom app destination.
Select only the alert moments needed by that team.
Trigger one safe test moment and confirm event, site, and delivery headers.
Repeat the same delivery ID at your receiver and confirm it is processed once.
Enable the destination, then monitor your receiver's accepted and rejected counts.

Next guide

CRM inbound updates