API and webhook

Webhook

We call you. When a watch fires, Spike POSTs JSON to every active HTTPS endpoint on the account. Endpoints apply to every project. Add them in Integrations → Webhooks. The signing secret is shown once (prefix whsec_). On channels already being polled, the hit is usually within 20 minutes of the line — median about 7 minutes on our tracker (Sept 2026). That is not an SLA.

A delivery row is created only for hits that fire after the endpoint exists. Older events are not backfilled.

Endpoint rules

• Public https:// only. Localhost and private-network URLs are rejected.
• Respond 2xx within 12 seconds. Redirects count as failure.

Headers

Content-Type: application/json
User-Agent: Spike-Webhook/1.0
X-SpikeYT-Signature: sha256=<hex>
X-SpikeYT-Event: video.threshold_reached
X-SpikeYT-Delivery: 1842

User-Agent is Spike-Webhook/1.0. Legacy X-AlertYT-* headers are sent with the same values during the rename.

Body

Event type video.threshold_reached. channelId and videoId are the YouTube ids. id is the Spike event id. lastHourAdded is views added in about the last hour at fire — the same number as the Events badge — or null if we could not calculate it. Not a forecast.

{
  "id": 1842,
  "type": "video.threshold_reached",
  "created": "2026-09-02T00:18:11Z",
  "data": {
    "watchId": 12,
    "projectId": 1,
    "projectName": "Main",
    "channelId": "UCxxxxxxxxxxxxxxxxxxxxxx",
    "channelTitle": "MrBeast",
    "videoId": "dQw4w9WgXcQ",
    "videoTitle": "Why this hook is printing views",
    "videoUrl": "https://www.youtube.com/watch?v=dQw4w9WgXcQ",
    "publishedAt": "2026-09-01T23:18:00Z",
    "viewCount": 3280,
    "lastHourAdded": 3210,
    "threshold": 3000,
    "windowHours": 1
  }
}

Signature

X-SpikeYT-Signature: sha256=<hex> is HMAC-SHA256 of the raw JSON bytes with the endpoint secret. Do not verify a re-serialized object.

const crypto = require("crypto");
const expected = "sha256=" + crypto
  .createHmac("sha256", secret)
  .update(rawBody)
  .digest("hex");
// timing-safe compare to X-SpikeYT-Signature

Retries and delivery log

Automatic retries run up to 8 times (backoff from 2 minutes up to 60). After that the row stays failed until you retry in the dashboard. The last HTTP status and error are stored. We do not persist your response body.

Each event in the dashboard shows whether that hit was delivered. Integrations → Delivery log has HTTP status, the payload, and a manual retry (current URL and secret).

Send test POSTs X-SpikeYT-Event: webhook.test with sample JSON. Test pings are not written to the delivery log.