Webhooks let Lodgix notify an outside system the moment something happens in your account. When an event you subscribe to occurs, Lodgix sends an HTTP POST with a JSON payload to a URL you choose. This is how you connect Lodgix to automation platforms like n8n or to your own custom service.
You will find the Webhooks located under Modules > Integrations > Webhooks.
Create a Webhook
Go to Modules, then Integrations, then Webhooks.
Click Create Webhook (or Add Endpoint if you already have an existing webhook).
Give it a Name so you can recognize it later (for example, "n8n Webhook").
Enter the Endpoint URL. This must start with
https://. Lodgix will POST to this URL.Select the events you want to receive. Such as Message Received.
Click Create.
Request headers
Every delivery includes these headers:
X-Lodgix-Event The event type, for example message.received
X-Lodgix-Delivery A unique ID for this delivery
X-Lodgix-Timestamp Unix time (seconds) when the request was signed
X-Lodgix-Signature The signature of the payload (see Verifying below)
Verifying the payload is really from Lodgix
Every request is signed with the secret from your endpoint, so you can confirm it genuinely came from Lodgix and was not tampered with. The signature is in the X-Lodgix-Signature header in the form sha256=<hash>, where the hash is:
HMAC_SHA256(secret, "{X-Lodgix-Timestamp}.{raw request body}")To verify a request:
Read the
X-Lodgix-TimestampandX-Lodgix-Signatureheaders.Compute
HMAC_SHA256(your_secret, timestamp + "." + raw_body).Compare it to the value after
sha256=in the header. Use a constant time comparison.Reject the request if the timestamp is more than 5 minutes old, to prevent replay.
Important: sign the raw request body exactly as received. Do not re-serialize the JSON first, because changes in spacing or key order will produce a different signature.
n8n MHAC Verification Example
In the Webhook trigger node, turn Raw Body on under Options.
Add an Extract from File node (operation: Extract From Text File, input binary field:
data) to get the raw body as text.
Use a Crypto node (HMAC, SHA256) with the value
{{ $('Webhook').item.json.headers['x-lodgix-timestamp'] }}.{{ $json.body_text }}and your secret, output as HEX.
Compare
sha256=plus that value to thex-lodgix-signatureheader, and check the timestamp is recent, before continuing.