Webhooks

In this guide, we will look at how to register and consume webhooks to integrate your app with ola.cv. With webhooks, your app can know when something happens in ola.cv.

Registering Webhooks

To register a new webhook, you need to have a URL in your app that ola.cv can call. You can configure a new webhook from the ola.cv dashboard under API Settings > Webhooks and add your Webhook URL.

Consuming Webhooks

When your app receives a webhook request from ola.cv, check the type attribute to see what event caused it. The first part of the event type will tell you the payload type, e.g., site.updated, etc.

{
  "type": "site.created",
  "data": {
    "id": "487560937166983168",
    "name": "Jane Doe",
    "slug": "puts-box",
    "template": "professional-profile",
    "status": "pending",
    "domain": null,
    "domain_registered_at": null,
    "created_at": "2026-09-07T09:53:05.000000Z",
    "generated_at": null
  },
  "sent_at": "2026-09-07T09:53:05+00:00"
}

In the example above, a site was created, and the payload type is a site.created.

Security

Since your webhook URL is publicly available, you need to verify that events originate from ola.cv and not a bad actor. There are two ways to ensure events to your webhook URL are from ola.cv:

1. Signature validation
2. IP whitelisting

Signature validation

Events sent from ola.cv carry the x-olacv-signature header. The value of this header is a HMAC_SHA256 signature of the event payload signed using your secret key. Verifying the header signature should be done before processing the event:

$signature = $request['headers']['x-ola-signature'] ?? '';
$payload = file_get_contents('php://input');

if ($signature === '') {
  http_response_code(401);
  exit('Missing signature');
}

$expectedSignature = hash_hmac('sha256', $payload, OLA_SECRET_KEY);
if (!hash_equals($expectedSignature, $signature)) {
  http_response_code(401);
  exit('Invalid signature');
}

// Process the webhook here.

If your generated signature matches the x-olacv-signature header, you can be sure that the request was truly coming from ola.cv. It's essential to keep your secret webhook key safe — otherwise, you can no longer be sure that a given webhook was sent by ola.cv. Don't commit your secret webhook key to GitHub!

IP Whitelisting

With this method, you only allow certain IP addresses to access your webhook URL while blocking out others. ola.cv will only send webhooks from the following IP addresses:

1. 34.229.119.19
2. 3.226.76.180

You should whitelist these IP addresses and consider requests from other IP addresses a counterfeit.

Event types

Whenever a request is unsuccessful, the ola.cv API will return an error response with an error type and message. You can use this information to understand better what has gone wrong and how to fix it. Most of the error messages are pretty helpful and actionable.

Here are some of the webhook you may encounter while working with the API.

{
  "type": "domain.delegated",
  "data": {
    "domain":"jane-doe.cv"
  },
  "sent_at": "2026-09-07T09:53:29+00:00"
}