Webhooks
and Volunteer Shift Manager

Every nonprofit reaches a point where the software it uses stops matching the shape of the organization. You've got a donor CRM that finance cares about, a spreadsheet the board reads, and a volunteer system that knows who actually turned up on Saturday. None of them talk to each other, so once a month somebody exports a CSV and does the joining by hand.

Webhooks are the escape hatch for that. Instead of you going to fetch the data, we send it to you the moment something happens.

What gets sent

Nine event types, and you choose which ones you want:

• volunteer.created, volunteer.updated, volunteer.removed
• signup.created, signup.waitlisted, signup.promoted, signup.canceled
• volunteer.checked_in, volunteer.checked_out

There's also a ping event for testing, so you can confirm your endpoint works before relying on it.

Each one arrives as a JSON POST to a URL you control. The check-in and check-out events are the two that tend to matter most, because they're the difference between who said they'd come and who actually did. If you're doing any kind of hours reporting for grants, that distinction is the whole ballgame.

Verifying that events are genuine

Anyone can send a POST to a public URL. So every request we send carries an X-Webhook-Signature header containing an HMAC-SHA256 of the raw request body, keyed by a signing secret we generate when you create the webhook.

Your endpoint should compute the same hash and compare before doing anything with the payload. If they don't match, discard it. The webhook docs have the exact payload shapes and a verification example you can copy.

You can reveal or rotate the signing secret at any time from the app. Rotate it if it's ever been pasted somewhere it shouldn't have been, which happens more often than anyone admits. While you're thinking about it, our guide to volunteer data security covers the wider habits worth having.

When deliveries fail

Your server will go down at some point, or a deploy will take it offline for a minute, and a webhook will arrive during that window. Failed deliveries are retried rather than dropped.

You also get a delivery history in the app showing each attempt with its status and HTTP response code. That log is more useful than it sounds. When someone says "the sync is broken," it immediately tells you whether we sent the event and your server rejected it, or whether the event never fired because the thing you expected to happen didn't actually happen. Those are very different problems and the log settles the argument in seconds.

Being honest about who this is for

Webhooks are a developer feature. Not a hard one, but you do need somewhere to receive an HTTPS POST and code to verify a signature.

If your organization has a technical volunteer, a contractor, or someone who's comfortable wiring up a no-code automation tool, this opens up genuinely useful things: pushing check-ins into a donor CRM so volunteer engagement shows up next to giving history, logging hours to a spreadsheet your board already reads, or triggering a thank-you in whatever system you use for that.

If nobody on your team is going to build that, be realistic. Mailchimp and Slack solve the common versions of the same problem with no code at all, and they'll serve you better than a webhook that never gets an endpoint pointed at it.

What doesn't exist, so you're not left looking for it: there's no published Zapier app, no pre-built CRM connector, and no public API for reading your data on demand. Webhooks push to you when things happen. They don't let you query.

A worked example

The most common useful setup we see is small: a webhook on volunteer.checked_out pointed at a script that appends a row to a shared spreadsheet, with columns for the volunteer, the program, and the hours.

That's maybe twenty lines of code. It also quietly removes the monthly chore of assembling that same spreadsheet by hand, and it's accurate in a way a monthly reconstruction never is, because it records what happened when it happened rather than what somebody remembered afterwards. Our piece on keeping volunteer data useful has more on why the recording moment matters so much.

Start there before building anything ambitious. A webhook that reliably does one small thing beats an integration plan that never quite gets finished.

Getting started

On the Integrations page, add a destination URL, pick your events, and copy the signing secret. Send the ping event to confirm it arrives and verifies. Then switch on the events you actually want.

Webhooks are part of Engage, at $19 a month. If you've got somewhere to put the data, this is how you get it there.