Promptwatch Logo

Customer.io webhooks

Customer.io's webhook service for event-driven marketing automation and customer data platform.
Customer.io
Webhook

What is Customer.io webhooks?

Customer.io sends several kinds of outbound webhooks. A workflow's Send and receive data action can call an external API for each person moving through an automation. Reporting webhooks send message delivery activity to a configured endpoint. The Data Pipelines webhook destination forwards selected source data after applying its mapping.

Workflow and reporting webhooks use X-CIO-Timestamp and X-CIO-Signature. Customer.io signs the raw bytes formed by the literal v0:, the timestamp, another colon, and the untouched body with HMAC SHA-256. Reporting webhook keys are configured with the reporting endpoint, while workflow signing keys are stored under the workspace's API and webhook credentials.

The Data Pipelines destination has a different optional scheme. When a shared secret is set, it sends X-Signature, a hex-encoded HMAC SHA-1 digest of the request body. Receivers must not apply the X-CIO-Signature algorithm to this header. Delivery timing also differs: workflow actions have a 16-second timeout and retry selected failures up to 11 times over about an hour, while reporting webhooks use a four-second timeout and can retry over seven days.

These callbacks carry customer, campaign, or delivery data to an endpoint selected by the workspace. They do not crawl the endpoint's pages or affect AI search and model training. Robots.txt has no place in any of the Customer.io webhook flows.

Not relevant for AI search

Is Customer.io webhooks relevant for AI search?

No. Customer.io webhooks is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

Customer.io webhooks is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle Customer.io webhooks

First identify which Customer.io feature owns the endpoint. For workflow and reporting webhooks, preserve the raw body and verify X-CIO-Signature with the timestamp and the signing key assigned to that feature. For a Data Pipelines destination, configure a shared secret and verify its X-Signature HMAC SHA-1 value instead.

Reject a failed signature before using profile or delivery data. Store a verified request or make its business action idempotent before returning 2xx, since automatic and manual retries can create another request. Size the endpoint response time for the feature's documented timeout rather than doing slow work inline.

To stop traffic, disable the workflow action, reporting webhook, or Data Pipelines destination that owns it, then close the route if nothing else uses it. Do not authenticate Customer.io by a user-agent guess, and do not add robots.txt rules for these endpoints.

Examples

  • A person reaches a workflow step, and Customer.io calls a fulfillment API with Liquid-rendered order data.
  • A reporting webhook sends an email bounce event whose `X-CIO-Signature` is checked before the address is suppressed.
  • A Data Pipelines destination signs a transformed profile event in `X-Signature`, so the receiver uses the configured SHA-1 scheme.
  • A workflow request returns 500 after partially succeeding, and its retry is harmless because the external action uses an idempotency key.

Frequently asked questions about Customer.io webhooks

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

Reporting webhooks and workflow Send and receive data actions use it with `X-CIO-Timestamp` and an HMAC SHA-256 signing key.

Related bots

Adyen Webhook

Adyen sends HTTP POST webhooks for events that a payment integration cannot safely infer from a browser return or an immediate API response.

Webhook

Atlassian Jira Webhooks

Delivers webhook notifications from Jira Cloud when issues, projects, or other resources change.

Webhook

Facebook Webhooks

Facebook's webhook service that delivers real-time event notifications for Meta platform events and changes.

Webhook

FalBot

fal.ai's webhook service that delivers asynchronous notifications for AI model processing and generation tasks.

Webhook

GitHub Hookshot

GitHub's webhooks for events like push, pull request, etc.

Webhook

Be the brand AI recommends

Monitor your brand's visibility across ChatGPT, Claude, Perplexity, and Gemini. Get actionable insights and create content that gets cited by AI search engines.

Promptwatch Dashboard