# List contributors
Source: https://docs.onset.io/api-reference/contributors/list-contributors
https://api.onset.io/v1/openapi.yml get /contributors
Retrieve a paginated list of contributors (workspace members) that can be assigned to releases
# Create a new incoming webhook
Source: https://docs.onset.io/api-reference/incoming-webhooks/create-a-new-incoming-webhook
https://api.onset.io/v1/openapi.yml post /incoming-webhooks
Create a new incoming webhook in the workspace
# Delete incoming webhook
Source: https://docs.onset.io/api-reference/incoming-webhooks/delete-incoming-webhook
https://api.onset.io/v1/openapi.yml delete /incoming-webhooks/{id}
Delete an incoming webhook by its ID
# Get incoming webhook by ID
Source: https://docs.onset.io/api-reference/incoming-webhooks/get-incoming-webhook-by-id
https://api.onset.io/v1/openapi.yml get /incoming-webhooks/{id}
Retrieve a specific incoming webhook by its ID
# List incoming webhooks
Source: https://docs.onset.io/api-reference/incoming-webhooks/list-incoming-webhooks
https://api.onset.io/v1/openapi.yml get /incoming-webhooks
Retrieve a list of incoming webhooks
# Update incoming webhook
Source: https://docs.onset.io/api-reference/incoming-webhooks/update-incoming-webhook
https://api.onset.io/v1/openapi.yml patch /incoming-webhooks/{id}
Update an existing incoming webhook
# List labels
Source: https://docs.onset.io/api-reference/labels/list-labels
https://api.onset.io/v1/openapi.yml get /labels
Retrieve a paginated list of labels in the workspace
# Delete milestone
Source: https://docs.onset.io/api-reference/milestones/delete-milestone
https://api.onset.io/v1/openapi.yml delete /milestones/{id}
Delete a milestone by its ID
# Get milestone by ID
Source: https://docs.onset.io/api-reference/milestones/get-milestone-by-id
https://api.onset.io/v1/openapi.yml get /milestones/{id}
Retrieve a specific milestone by its ID
# List milestones
Source: https://docs.onset.io/api-reference/milestones/list-milestones
https://api.onset.io/v1/openapi.yml get /milestones
Retrieve a paginated list of milestones with optional filtering by status, visibility, project, and other criteria
# Update milestone
Source: https://docs.onset.io/api-reference/milestones/update-milestone
https://api.onset.io/v1/openapi.yml patch /milestones/{id}
Update an existing milestone
# List projects
Source: https://docs.onset.io/api-reference/projects/list-projects
https://api.onset.io/v1/openapi.yml get /projects
Retrieve a paginated list of projects in the workspace
# Create a new release
Source: https://docs.onset.io/api-reference/releases/create-a-new-release
https://api.onset.io/v1/openapi.yml post /releases
Create a new release in the workspace. Releases are always created as drafts — use POST /releases/{id}/publish to publish or schedule one.
# Delete release
Source: https://docs.onset.io/api-reference/releases/delete-release
https://api.onset.io/v1/openapi.yml delete /releases/{id}
Delete a release by its ID
# Get release by ID
Source: https://docs.onset.io/api-reference/releases/get-release-by-id
https://api.onset.io/v1/openapi.yml get /releases/{id}
Retrieve a specific release by its ID
# List releases
Source: https://docs.onset.io/api-reference/releases/list-releases
https://api.onset.io/v1/openapi.yml get /releases
Retrieve a list of releases with optional filtering
# Publish release
Source: https://docs.onset.io/api-reference/releases/publish-release
https://api.onset.io/v1/openapi.yml post /releases/{id}/publish
Publish a draft or scheduled release to the changelog, either immediately or at a future date. Use this to publish a scheduled release early, or to move a scheduled release to a different date. Returns 400 if the release is already published.
# Update release
Source: https://docs.onset.io/api-reference/releases/update-release
https://api.onset.io/v1/openapi.yml patch /releases/{id}
Update the content of an existing release. Cannot publish or unpublish — use POST /releases/{id}/publish for that.
# Create a new subscriber list
Source: https://docs.onset.io/api-reference/subscriber-lists/create-a-new-subscriber-list
https://api.onset.io/v1/openapi.yml post /subscriber-lists
Create a new subscriber list in the workspace
# Delete subscriber list
Source: https://docs.onset.io/api-reference/subscriber-lists/delete-subscriber-list
https://api.onset.io/v1/openapi.yml delete /subscriber-lists/{id}
Delete a subscriber list by its ID
# Get subscriber list by ID
Source: https://docs.onset.io/api-reference/subscriber-lists/get-subscriber-list-by-id
https://api.onset.io/v1/openapi.yml get /subscriber-lists/{id}
Retrieve a specific subscriber list by its ID
# List subscriber lists
Source: https://docs.onset.io/api-reference/subscriber-lists/list-subscriber-lists
https://api.onset.io/v1/openapi.yml get /subscriber-lists
Retrieve a list of subscriber lists
# Update subscriber list
Source: https://docs.onset.io/api-reference/subscriber-lists/update-subscriber-list
https://api.onset.io/v1/openapi.yml patch /subscriber-lists/{id}
Update an existing subscriber list
# Create a new subscriber
Source: https://docs.onset.io/api-reference/subscribers/create-a-new-subscriber
https://api.onset.io/v1/openapi.yml post /subscribers
Create a new subscriber in the workspace
# Delete subscriber
Source: https://docs.onset.io/api-reference/subscribers/delete-subscriber
https://api.onset.io/v1/openapi.yml delete /subscribers/{id}
Delete a subscriber by their ID
# Get subscriber by ID
Source: https://docs.onset.io/api-reference/subscribers/get-subscriber-by-id
https://api.onset.io/v1/openapi.yml get /subscribers/{id}
Retrieve a specific subscriber by their ID
# List subscribers
Source: https://docs.onset.io/api-reference/subscribers/list-subscribers
https://api.onset.io/v1/openapi.yml get /subscribers
Retrieve a list of subscribers, newest first, with optional filtering by subscriber list
# Update subscriber
Source: https://docs.onset.io/api-reference/subscribers/update-subscriber
https://api.onset.io/v1/openapi.yml patch /subscribers/{id}
Update an existing subscriber
# Create a new webhook
Source: https://docs.onset.io/api-reference/webhooks/create-a-new-webhook
https://api.onset.io/v1/openapi.yml post /webhooks
Create a new webhook in the workspace
# Delete webhook
Source: https://docs.onset.io/api-reference/webhooks/delete-webhook
https://api.onset.io/v1/openapi.yml delete /webhooks/{id}
Delete a webhook by its ID
# Get webhook by ID
Source: https://docs.onset.io/api-reference/webhooks/get-webhook-by-id
https://api.onset.io/v1/openapi.yml get /webhooks/{id}
Retrieve a specific webhook by its ID
# List webhooks
Source: https://docs.onset.io/api-reference/webhooks/list-webhooks
https://api.onset.io/v1/openapi.yml get /webhooks
Retrieve a list of webhooks
# Update webhook
Source: https://docs.onset.io/api-reference/webhooks/update-webhook
https://api.onset.io/v1/openapi.yml patch /webhooks/{id}
Update an existing webhook
# Get workspace information
Source: https://docs.onset.io/api-reference/workspace/get-workspace-information
https://api.onset.io/v1/openapi.yml get /workspace
Retrieve information about the current authenticated workspace, including its ID, name, slug, public page URL, and the configured release change types and roadmap status types
# Introduction
Source: https://docs.onset.io/developers/api-reference/introduction
The Onset API is a [REST](https://en.wikipedia.org/wiki/Representational_state_transfer)ful API accessed by an HTTP client such as `curl` or the HTTP library, which is part of most modern programming languages. You can use this API to build custom integrations or automate even more of your organization's workflow.
## Authentication
The Onset API uses API keys to authenticate requests. You can view and manage your API keys in the Onset Dashboard.
Your API keys carry many privileges, so be sure to keep them secure! Do not share your secret API keys in publicly accessible areas such as GitHub, client-side code, and so forth.
Authentication to the API is performed via [HTTP Basic Auth](https://en.wikipedia.org/wiki/Basic_access_authentication). Provide your API key as the basic auth username value. You do not need to provide a password.
```shell theme={null}
curl https://api.onset.io/v1/workspace \
-u {API_KEY}:
```
If you need to authenticate via bearer auth use `-H "Authorization: Bearer API_KEY"` instead of `-u API_KEY`.
```sh theme={null}
curl https://api.onset.io/v1/workspace \
-H 'Authorization: Bearer {API_KEY}'
```
## Creating and publishing releases
Releases are created and edited as **drafts**, then published in a separate
step. `POST /v1/releases` and `PATCH /v1/releases/{id}` never change a release's
status — publishing goes through a dedicated endpoint:
```sh theme={null}
# 1. Create a draft
curl https://api.onset.io/v1/releases \
-H 'Authorization: Bearer {API_KEY}' \
-H 'Content-Type: application/json' \
-d '{ "title": "Version 2.1", "slug": "version-2-1", "body": "
What is new
" }'
# 2. Publish it
curl https://api.onset.io/v1/releases/{id}/publish \
-H 'Authorization: Bearer {API_KEY}' \
-H 'Content-Type: application/json' \
-d '{ "status": "RELEASED" }'
```
To publish at a future date, send `{"status": "SCHEDULED", "scheduled_at":
"2026-08-01T09:00:00.000Z"}` instead. The same endpoint publishes a scheduled
release early (`RELEASED`) or moves it to a different date.
Publishing is what emits the `release.published` and `release.scheduled`
[webhooks](/developers/webhooks), so integrations get an accurate signal of when
a release actually went live.
Publishing over the API does not send subscriber emails or Slack and Discord
announcements. Publish from the Onset dashboard to choose notification
channels.
## Versioning
The API is versioned with a single number, which is currently 1. This number symbolizes the major version number, as described by [SemVer](https://semver.org/). Because of this, backward-incompatible changes require this version number to change.
The minor version isn't explicit, which allows for a stable API endpoint. New features can be added to the API in the same version number.
API requests must be made over HTTPS and include the API version.
# Incoming Webhooks
Source: https://docs.onset.io/developers/incoming-webhook
Create releases and subscribers in Onset by sending a JSON POST from CI, a deploy script, or any external service.
An incoming webhook gives you a URL that turns an HTTP POST into an object in your
workspace. Point your CI pipeline, deploy script, or any tool that can send a
webhook at it, and Onset creates the release or subscriber for you.
Unlike the [REST API](/developers/api-reference/introduction), there's no API key
to manage. The secret is baked into the URL, so a service that can only send "a
POST to a URL" — GitHub Actions, Zapier, a shell script — can write to Onset.
There are two types:
| Type | What a POST creates |
| -------------- | -------------------------------------------- |
| **Release** | A new release, saved as a **draft**. |
| **Subscriber** | A new subscriber, optionally added to lists. |
## Create a webhook
In the dashboard, go to **Settings → Developers → Incoming Webhooks**.
Click **Create webhook**, give it a name, and pick the event type. The type
can't be changed afterwards — create a second webhook if you need both.
Copy the endpoint from the **Webhook Endpoint** column and store it as a
secret in whatever service will call it.
Your URL looks like this:
```
https://webhooks.onset.io/v1/{webhook_id}/{secret}
```
The URL **is** the credential — anyone holding it can write to your workspace.
Store it as a secret, never commit it, and don't put it in client-side code or
logs. If it leaks, delete the webhook and create a new one.
## Sending a request
Send a `POST` with a JSON body and `Content-Type: application/json`. No
authentication headers are needed.
The body uses the same field names as the equivalent REST API endpoint, so
anything you can build with the API you can send here.
```bash theme={null}
curl -X POST https://webhooks.onset.io/v1/{webhook_id}/{secret} \
-H "Content-Type: application/json" \
-d '{
"title": "Search and export improvements",
"slug": "search-and-export-improvements",
"version": "2.4.0",
"body": "This release focuses on **search quality** and CSV exports.",
"changes": [
{ "title": "Added", "content": "CSV export for subscriber lists" },
{ "title": "Fixed", "content": "Search now matches partial words" }
],
"is_public": true
}'
```
| Field | Type | Notes |
| ----------------- | --------- | ------------------------------------------------------------------------------------------------------------------- |
| `title` | string | **Required.** 3–255 characters. |
| `slug` | string | **Required.** Lowercase letters, numbers and hyphens, 3–255 characters. A suffix is appended if it's already taken. |
| `body` | string | Markdown or HTML. |
| `version` | string | Free-form version label, e.g. `2.4.0`. |
| `changes` | array | Labelled one-liners rendered as badges above the body. See [Change types](#change-types). |
| `is_public` | boolean | Defaults to `false`. |
| `is_pinned` | boolean | Defaults to `false`. |
| `is_pre_release` | boolean | Defaults to `false`. |
| `project_id` | string | ID of a [project](/guides/projects). |
| `label_ids` | string\[] | IDs of [labels](/guides/labels). |
| `contributor_ids` | string\[] | IDs of [contributors](/guides/releases/contributors). |
| `hero` | object | `{ "type": "image" \| "video", "url": "..." }`. Omit for none — `null` is not accepted. |
| `attachments` | array | File or link attachments. |
The response is the created release, in the same shape the REST API returns.
```bash theme={null}
curl -X POST https://webhooks.onset.io/v1/{webhook_id}/{secret} \
-H "Content-Type: application/json" \
-d '{
"email": "ada@example.com",
"list_ids": ["clx1a2b3c4d5e6f7g8h9i0j1"]
}'
```
| Field | Type | Notes |
| ---------- | --------- | -------------------------------------------------------------------- |
| `email` | string | **Required.** Must be a valid email address. |
| `list_ids` | string\[] | IDs of [subscriber lists](/guides/subscribers/lists) to add them to. |
The response is the created subscriber, including the lists they joined.
### Releases arrive as drafts
A release created through an incoming webhook is always saved with status
`DRAFT`, even if `is_public` is `true`. Nothing appears on your public page,
and no subscriber emails or Slack/Discord announcements go out, until someone
publishes it from the dashboard or via the API.
That's deliberate: it lets a deploy pipeline stage release notes automatically
while a human still decides when customers see them. See
[Publishing](/guides/releases/publishing).
### Change types
Each entry in `changes` must use the `title` of a change type configured in your
workspace (**Settings → Releases**), matched case-insensitively. The badge colour
comes from that configuration, so it isn't accepted in the payload.
An unrecognised title returns `400` with the list of titles your workspace
accepts, so you can correct the call without a second lookup. If you'd rather not
deal with change types, leave `changes` out and write everything into `body`.
## Responses
A successful call returns `200` with the created object.
| Status | Meaning |
| ------ | ----------------------------------------------------------------------------------------------- |
| `400` | The payload failed validation. The `errors` object maps each field to its problems. |
| `402` | Creating this subscriber would exceed your plan's subscriber limit. |
| `404` | The webhook ID and secret don't match an existing webhook — usually a truncated or rotated URL. |
| `410` | A milestone webhook. See below. |
Errors have a consistent shape:
```json theme={null}
{
"success": false,
"message": "Invalid request",
"errors": {
"title": ["String must contain at least 3 character(s)"]
}
}
```
## Example: publish from GitHub Actions
Draft a release in Onset whenever you tag a version:
```yaml theme={null}
name: Draft release notes
on:
push:
tags: ['v*']
jobs:
onset:
runs-on: ubuntu-latest
steps:
- name: Create Onset draft
run: |
VERSION="${GITHUB_REF_NAME#v}"
curl -sSf -X POST "$ONSET_WEBHOOK_URL" \
-H "Content-Type: application/json" \
-d "$(jq -n --arg v "$VERSION" '{
title: ("Release " + $v),
slug: ("release-" + ($v | gsub("\\."; "-"))),
version: $v,
is_public: true
}')"
env:
ONSET_WEBHOOK_URL: ${{ secrets.ONSET_WEBHOOK_URL }}
```
The draft lands in your dashboard for editing before you publish it.
## Managing webhooks programmatically
Incoming webhooks can also be created, listed, updated and deleted through the
[REST API](/developers/api-reference/introduction) under `/incoming-webhooks`, or
with the Node SDK:
```javascript theme={null}
const webhook = await onset.incomingWebhooks.create({
name: 'CI deploy notes',
type: 'RELEASE',
});
```
## Milestone webhooks
Milestone incoming webhooks can no longer be created, and calls to existing ones
return `410 Gone`. The roadmap is being deprecated and will be disabled on
**October 5**. Existing milestone webhooks stay visible in settings so you can
find and delete them.
Incoming webhooks are for sending data **into** Onset. To receive notifications
**from** Onset when something changes, see [Webhooks](/developers/webhooks).
# MCP Server
Source: https://docs.onset.io/developers/mcp
Connect Onset to Claude, Cursor, VS Code, Codex and other AI clients to read and write your changelog in natural language.
The Onset MCP server lets AI assistants and coding agents work with your changelog
directly: listing releases, drafting and publishing new ones, and managing
subscribers, without leaving the chat or your editor.
It implements the [Model Context Protocol](https://modelcontextprotocol.io) over
Streamable HTTP, and authenticates with OAuth 2.1, so you sign in with your normal
Onset account. No API key required.
**Server URL:** `https://mcp.onset.io/mcp`
## Connect your client
Any client that supports remote MCP servers over Streamable HTTP with OAuth can
connect. Point it at `https://mcp.onset.io/mcp` — there's no API key to paste.
In Claude, go to **Settings → Connectors** and click **Add custom connector**.
Paste `https://mcp.onset.io/mcp` and continue.
You'll be redirected to Onset to sign in (or you'll continue with your existing
session).
Pick the workspace you want to connect, then click **Authorize**. Access is
limited to that one workspace.
Add the server from your terminal:
```bash theme={null}
claude mcp add --transport http onset https://mcp.onset.io/mcp
```
Then run `/mcp` inside Claude Code, pick **onset**, and complete the sign-in
and workspace selection in your browser. Tokens are stored and refreshed for
you; use **Clear authentication** in the `/mcp` menu to revoke access.
Add `--scope project` to share the server with your team through a checked-in
`.mcp.json`, or `--scope user` to make it available in every project.
Add Onset to `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project only):
```json theme={null}
{
"mcpServers": {
"onset": {
"url": "https://mcp.onset.io/mcp"
}
}
}
```
Open **Settings → Features → Model Context Protocol**. Cursor discovers the
Onset authorization server automatically, registers itself, and opens your
browser so you can sign in and pick a workspace.
Add Onset to `.vscode/mcp.json` in your project:
```json theme={null}
{
"servers": {
"onset": {
"type": "http",
"url": "https://mcp.onset.io/mcp"
}
}
}
```
Or run **MCP: Add Server** from the Command Palette and choose **HTTP**, which
writes the same entry. To make Onset available everywhere instead of one
project, use **MCP: Open User Configuration**.
On first use, VS Code opens a browser window for the OAuth flow. Start the
server with **MCP: List Servers → onset → Start** if it hasn't connected yet.
Add the server from your terminal:
```bash theme={null}
codex mcp add onset --url https://mcp.onset.io/mcp
codex mcp login onset
```
Or edit `~/.codex/config.toml` directly:
```toml theme={null}
[mcp_servers.onset]
url = "https://mcp.onset.io/mcp"
```
`codex mcp login onset` opens your browser for the OAuth flow. Run `/mcp` in
the Codex TUI to confirm the server is connected. The CLI and the IDE
extension share this config, so you only set it up once.
Once connected, ask things like *"What did we ship last month?"* or
*"Draft a release for version 2.1 from these notes."*
## Workspace access
Each connection is scoped to a **single workspace**, chosen at the moment you
authorize. The workspace is bound into the access token, and every request is
re-checked against your current membership, so if you're removed from a
workspace, the connection stops working immediately.
To connect a different workspace, authorize again and select it. Each workspace
is granted separately.
Anyone who can access a workspace through the Onset API can use these tools for
that workspace.
## Available tools
### Releases
| Tool | Description |
| ----------------- | ---------------------------------------------------------------- |
| `list_releases` | List releases, optionally filtered by status, project, or labels |
| `get_release` | Get a single release by id or number |
| `create_release` | Create a new release as a **draft** |
| `update_release` | Update the content of an existing release |
| `publish_release` | Publish a release now, schedule it, or reschedule it |
### Projects, labels & contributors
| Tool | Description |
| ------------------- | ------------------------------------------------ |
| `list_projects` | List projects in the workspace |
| `list_labels` | List labels in the workspace |
| `list_contributors` | List workspace members available as contributors |
### Subscribers
| Tool | Description |
| ----------------------- | ---------------------------------------------- |
| `list_subscribers` | List changelog subscribers |
| `list_subscriber_lists` | List subscriber lists |
| `create_subscriber` | Add a subscriber, optionally to specific lists |
Read tools can run without confirmation. Tools that create or change data will
ask you to confirm before running.
Creating, updating or publishing a release, and adding a subscriber, fire the
same [webhooks](/developers/webhooks) as the REST API and dashboard. If your
workspace has webhook endpoints configured, those requests are sent to your
external URLs.
## Drafts and publishing
`create_release` always creates a **draft**. Nothing appears on your changelog
until it's published, so you can let an assistant write a release and review it
before anyone sees it.
Publishing is a separate, explicit step (`publish_release`), and most clients ask
you to confirm before running it. You can publish immediately (`RELEASED`) or
schedule it for a future date (`SCHEDULED`, available on plans that include
scheduled releases).
The same tool works on a release that's already scheduled, so you can ask to
publish it early or move it to a different date. Once a release is live, use
`update_release` to change its content.
This mirrors the [REST API](/developers/api-reference/introduction), where
releases are also created as drafts and published through a separate endpoint.
**Notifications are never sent over MCP.** Publishing through an AI assistant
does not send subscriber emails or Slack and Discord messages. To notify people,
publish from the Onset dashboard, where you choose the channels.
## Prompts and resources
Alongside tools, the server exposes:
* **`draft_release_notes`** is a prompt that turns a list of changes into
structured release notes. Provide your highlights plus an optional version and
tone.
* **`onset://releases/{id}`** exposes your releases as readable Markdown, so clients
that support resources can pull a release into context directly.
Support for prompts and resources varies by AI client. All clients support tools.
## Plan limits
MCP requests count toward the same plan limits as the REST API. For example,
adding a subscriber fails once you reach your plan's subscriber limit.
## Troubleshooting
Confirm the URL is exactly `https://mcp.onset.io/mcp`. Web clients like Claude
connect from their own servers, so the endpoint must be reachable from the
public internet.
Some clients don't start the OAuth flow until the server is running. In VS Code
use **MCP: List Servers → onset → Start**, in Claude Code run `/mcp`, and in
Codex run `codex mcp login onset`.
Your connection may point at a workspace you're no longer a member of.
Remove the server and add it again, selecting a current workspace.
Reconnect and pick the workspace you want on the authorization screen. Each
connection covers exactly one workspace.
Restart the server or reload the client. In VS Code, run **MCP: Reset Cached
Tools**. In Cursor, check **Output → MCP Logs** for connection errors.
# Webhooks
Source: https://docs.onset.io/developers/webhooks
Onset provides webhooks which allow you to receive HTTP push notifications whenever data is created, updated or removed. This allows you to build integrations that respond to changes in real time, such as triggering CI builds, updating external systems, or sending messages based on release activity.
## Payload
The webhook HTTP payload will include information both in its HTTP headers and its request body.
### Header
HMAC signature of the webhook payload.
Event which triggered this webhook request.
Onset workspace Id.
### Body
Event which triggered this webhook request.
The actor who triggered the action. Could be a User, Visitor, or API.
Workspace ID
Webhook ID
UNIX timestamp when the webhook was sent.
Payload of the entity
## Securing Webhooks
You should ensure that webhooks you received were sent by Onset. You can do this by verifying the webhook request signature and timestamp.
Onset sends a `Onset-Signature` HTTP header with every webhook request. This header contains a hex-encoded HMAC-SHA256 signature of the raw body contents, signed using the webhook's signing secret. You can find the signing secret on the webhook's detail page.
The parsed JSON body has a `webhookTimestamp` field with a UNIX timestamp, in milliseconds, indicating the time when the webhook was sent. We recommend that you verify it's within a minute of the time your system sees it to guard against replay attacks.
To verify the webhook, you need to compute the signature of the request body using the webhook's signing secret and compare it against the `Onset-Signature` header. It's strongly recommended to use raw request body rather than restringifying a parsed JSON body, otherwise the signature may differ. Once the signature has been validated, check to ensure that the webhook timestamp is reasonably current before processing the request:
```javascript theme={null}
// Express example:
const crypto = require('node:crypto');
const express = require('express');
const ONSET_WEBHOOK_SECRET = process.env.ONSET_WEBHOOK_SECRET;
function verifySignature(headerSignatureString, rawBody) {
if (typeof headerSignatureString !== 'string') {
return false;
}
const headerSignature = Buffer.from(headerSignatureString, 'hex');
const computedSignature = crypto
.createHmac('sha256', ONSET_WEBHOOK_SECRET)
.update(rawBody)
.digest();
return crypto.timingSafeEqual(computedSignature, headerSignature);
}
const app = express();
app.post(
'/webhook',
express.json({
verify: (req, _res, buf) => {
// Capture the raw body for signature verification.
req.rawBody = buf;
},
}),
(req, res) => {
if (!verifySignature(req.get('onset-signature'), req.rawBody)) {
return res.sendStatus(401);
}
if (Math.abs(Date.now() - req.body.webhookTimestamp) > 60 * 1000) {
// Reject any webhooks not within 60 seconds of the current time to prevent replay attacks.
return res.sendStatus(401);
}
try {
// ... Handle verified webhook ...
return res.sendStatus(200);
} catch (err) {
// Indicate to Onset that there was a server error so the webhook is retried later.
return res.sendStatus(500);
}
},
);
app.listen(8080, () => console.log('Serving on port 8080'));
```
# Configuration
Source: https://docs.onset.io/developers/widget/configuration
## Options
Onset page domain without `https://`
Enable debug logs
Widget theme
Widget title
Show latest unseen release popup on load
Placement of popup window
Placement of widget window
## Callbacks
Called when the widget is ready
```typescript theme={null}
{
//..options
callbacks: {
onReady() {
}
}
}
```
Called when the widget has loaded data
```typescript theme={null}
{
//..options
callbacks: {
onLoaded(releases: Releases[]) {
}
}
}
```
Called when the widget is opened
```typescript theme={null}
{
//..options
callbacks: {
onWidgetOpen() {
}
}
}
```
Called when the widget is closed
```typescript theme={null}
{
//..options
callbacks: {
onWidgetClose() {
}
}
}
```
Called when the widget popup is opened
```typescript theme={null}
{
//..options
callbacks: {
onPopupOpen() {
}
}
}
```
Called when the widget popup is closed
```typescript theme={null}
{
//..options
callbacks: {
onPopupOpen() {
}
}
}
```
# Install
Source: https://docs.onset.io/developers/widget/install
It only takes a few minutes to install Onset widget on your website.
## How to install
There are two ways to install the Onset widget:
1. Using the **NPM** package
2. Using the **embed** script
Both methods give you access to the same widget API.
### 1. Install via npm
```shell npm theme={null}
npm install @onsetio/widget
```
```shell yarn theme={null}
yarn add @onset/widget
```
```typescript theme={null}
import { OnsetWidget } from "@onsetio/widget";
const widget = new OnsetWidget({
page: "PAGE_DOMAIN",
});
```
You can now control the widget using the exposed methods.
```typescript theme={null}
widget.openWidget();
widget.closeWidget();
```
Refer to the Methods section for the full API.
### 2. Install via embed script
Go to your Onset **Dashboard -> Settings -> Widget** and copy the provided `