Build
Routing webhooks
Receive sales, support, and handoff alerts at a customer-configured HTTPS destination.
Do not confuse alerts with CRM records
Routing webhooks deliver operational alerts selected by the customer in Routing. They do not use CRM field mappings and they do not use the CRM Webhook signature format.
| Routing webhook | CRM Webhook |
|---|---|
| Visitor alerts and handoff moments | Mapped CRM record operations |
| Signature is HMAC of exact JSON body | Signature includes timestamp and delivery ID |
| Configured as a Custom app destination | Configured under Integrations |
| Return any 2xx after acceptance | Return the documented operation response |
Receive and verify an alert
Concierge sends a JSON object containing event, siteId, occurredAt, and event-specific fields. If the customer configured a signing secret, compare X-Concierge-Signature with the lowercase HMAC-SHA256 hex of the exact raw body.
| Header | Purpose |
|---|---|
| X-Concierge-Event | Alert type selected by the customer |
| X-Concierge-Site-Id | Site that owns the alert |
| X-Concierge-Delivery-Id | Stable identity for receiver deduplication |
| X-Concierge-Signature | Optional raw-body HMAC-SHA256 hex |
Example alert
{
"event": "specialist_requested",
"siteId": "site_...",
"occurredAt": "2026-07-29T20:00:00.000Z",
"conversationId": "64f...",
"visitorName": "Taylor",
"pageUrl": "https://customer.example.com/pricing"
}Node signature check
import { createHmac, timingSafeEqual } from "node:crypto";
const expected = createHmac("sha256", process.env.CONCIERGE_ROUTING_SECRET)
.update(rawBody)
.digest("hex");
const supplied = request.headers["x-concierge-signature"] || "";
const valid = /^[a-f0-9]{64}$/i.test(supplied) && timingSafeEqual(
Buffer.from(expected, "hex"),
Buffer.from(supplied, "hex")
);The request timeout is short. Verify, deduplicate, enqueue your own slow work, and respond within four seconds.
Test the customer route
The customer creates the Custom app route in Concierge and selects the moments it should receive. Test with a non-production receiver before enabling live visitor traffic.
- 1Create an HTTPS endpoint and optional signing secret.
- 2In the site, open Routing and add the Custom app destination.
- 3Select only the alert moments needed by that team.
- 4Trigger one safe test moment and confirm event, site, and delivery headers.
- 5Repeat the same delivery ID at your receiver and confirm it is processed once.
- 6Enable the destination, then monitor your receiver's accepted and rejected counts.
Next guide
CRM inbound updates