Handling webhooks

When events occur in Plane, webhooks are sent to your Webhook URL.

Webhook headers

Header	Description
X-Plane-Delivery	Unique delivery ID
X-Plane-Event	Event type (e.g., issue, issue_comment)
X-Plane-Signature	HMAC-SHA256 signature for verification

Verify signature

Always verify the X-Plane-Signature header:

import hmac
import hashlib

def verify_signature(payload: bytes, signature: str, secret: str) -> bool:
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature)

Webhook payload

{
  "event": "issue",
  "action": "created",
  "webhook_id": "webhook-uuid",
  "workspace_id": "workspace-uuid",
  "data": { ... },
  "activity": {
    "actor": { "id": "user-uuid", "display_name": "John Doe" }
  }
}

See Webhook Events for all event types.