Member webhook to your CRM
Send every new member of your communities to Make, n8n, Zapier or your CRM, with the payload and the signature to check.
At the end of this page each person who joins one of your communities appears in your CRM a few seconds later, with their phone number.
How it works
For each event you can set one HTTPS URL. When someone joins a community of that event, Groupilot sends a JSON message to that URL. If your server does not answer, Groupilot retries for up to 24 hours.
Steps
Create the receiving URL
In Make, add a Custom webhook module and copy its URL. In n8n, add a Webhook node (method POST) and copy the production URL. In Zapier, use Webhooks by Zapier, Catch Hook. Your own server works too, as long as the URL is HTTPS and public.
Paste it on the event
Open the event, Settings, New member webhook. Paste the URL and save. Groupilot shows the signing secret once: copy it now, it is not shown again.
Send a test
Choose Send a test. Groupilot sends a webhook.test message. Your Make scenario or n8n workflow receives it and you can map the fields.
Map the fields in your tool
Take data.member.phone (and data.member.name when present) and create or update the contact in your CRM. Tag it with data.community_name or the event.
The message you receive
{
"id": "6f1c2d0e-…",
"type": "member.joined",
"version": "1",
"occurred_at": "2026-11-06T09:12:44.000Z",
"data": {
"project_id": "…",
"event_id": "…",
"webinar_id": "…",
"occurrence_community_id": "…",
"community_name": "Webinar Marie - 09/11",
"member": {
"phone": "+33612345678",
"name": "Julie"
}
}
}nameis missing when WhatsApp does not provide it.- A member can be sent more than once (for example after a retry). Use
idto ignore duplicates. webinar_idis the id of the occurrence,occurrence_community_idthe id of the community in Groupilot.
Headers: Content-Type: application/json, User-Agent: groupilot-webhook/1, X-Groupilot-Event-Id, X-Groupilot-Event-Type, and X-Groupilot-Signature.
Check the signature
The X-Groupilot-Signature header looks like t=1762420364,v1=5f3a…. To verify it, compute HMAC-SHA256 with your secret over the string t + "." + raw body and compare it with v1. Reject messages whose t is older than 5 minutes.
import { createHmac, timingSafeEqual } from "node:crypto";
export function verify(rawBody, header, secret) {
const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
const expected = createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
return fresh && timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
}In Make and n8n, checking the signature is optional: the URL itself is secret. Do it if the data goes into a system where a fake entry would matter.
Webhooks for the whole account
The member webhook covers one event. For everything else, open Settings, Integrations, Webhooks: add an address, tick the events you want (member joined, message sent or failed, community created or full, number disconnected, event paused, broadcast finished), copy the secret shown once, then use Test, Pause, New secret, Delete and Deliveries (last 10). Up to 5 addresses. An address that fails 50 times in a row is paused automatically and shows Paused (failures): fix it on your side, then resume it. Details and payloads in Outbound webhooks.
Retries
Groupilot waits 5 seconds for an answer. Any 2xx answer means delivered. On a timeout, a network error or a 408, 425, 429 or 5xx answer, it retries after about 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 15 hours, up to 7 attempts within 24 hours. Any other 4xx answer is final. The last 10 deliveries are listed under the webhook settings, with the status and the HTTP code.
Example
Marie connects Make: Custom webhook → "Search contact by phone" in her CRM → "Create or update contact" with the tag "Webinar WhatsApp". Every registrant who joins the group becomes a contact with the tag, and her follow-up sequence starts from there.