Spark and above. Go to Integrations → Webhooks.
Add your HTTPS URL.
Subscribe to
donation.completed, and optionallydonation.refundedanddonation.failed.Copy the signing secret (shown once).
Click Send test and confirm your server received the payload.
Verify signatures
Each request includes X-Sharity-Timestamp and X-Sharity-Signature (t=<unix>,v1=<hmac>). Compute HMAC-SHA256 of {timestamp}.{rawBody} with the signing secret and compare to the v1 hex value. Reject requests with a timestamp too far from now.
Use the event id for idempotency. Failed deliveries are retried automatically. Never expose the signing secret in client-side code.