Webhooks

About Webhooks

The Webhooks enables you to easily integrate and connect the Print.App platform to your outside platforms. For instance, you may want to send the PDF file of a project directly to your printer, or save all your user’s uploaded pictures in your DropBox or Google Drive. A Webhook makes this possible by invoking your specified external URL whenever an even happens on the Print.App platform along with the details of such an event for further actions. At the moment, we can notify you when:

A new project is created, the first time a customer’s design is saved. That can be an autosave, before the customer has finished.
A file is uploaded by your customer.

The exact payloads are at the end of this page. To check that a webhook really comes from Print.App, turn on signing. You can utilize the new-project Webhook to send the completed PDF/JPEG/PNG files to your print service provider.

Setting up a Webhook

To get started, navigate to the settings page in your Print.App admin and click the Webhooks tab. We need a service URL to send that notification to, for that service to get the file and save in a Google Drive. For this, we can use Zapier, a service that connects different apps and services together. We will create a Zap that listens to the Webhook notification and saves the file in your Google Drive.

Start

Register or login to Zapier and click the Make a Zap button on the top left hand corner. A Zap is simply a workflow link you create between apps on Zapier. You can read more here

Add a Trigger

That should take you to the Zap creation dashboard. Click the Trigger button

Select a Trigger

A window should popup, type in Webhook And select the Webhooks by Zapier option

Trigger Hook

On the right panel, click the Event and select Catch Hook option

Obtain Trigger URL

Click next twice to arrive on the Test tab. This should give you a URL to send the file to. Copy this URL

Add URL to Print.App settings

Open a new Tab and navigate to Print.App Settings Click the Webhooks Tab and paste the URL copied from the prior step and save

Test Trigger

On the Zapier page, click on the Test trigger button. Then quickly create a new customization / project on your store and save. Check the Zapier page, you should see a record from Print.App

Action

Click the Continue with record to choose an Action.
An Action is what happens after the Trigger event and for this, we will select Google Drive. You can opt for any other service you want to save the file to or even send as an email.

Google Drive Event

Select Upload File from the event list

Select File to Upload

Give Zapier permission to access your Google Drive account and click Next. Under action, scroll to the File section to pick which file you want to upload from the Print.App notification. Select the PDF file from the Print.App notification.

File Saved

Click the Test Step and Zapier should send the newly created PDF file to your Google Drive. You can check your Google Drive to confirm.

Save and Publish

Publish your Zap to save it.

Payloads

Each webhook is an HTTP POST with a JSON body. It carries these headers:

Header
`Content-Type`	`application/json`
`PrintApp-Event`	`project.created` or `file.uploaded`
`PrintApp-Event-Id`	Identifies the event. The same event always has the same id.
`PrintApp-Signature`	Only when signing is on.

New project

{
  "id": "project_2b6f1c9e-8d0a-4c3e-9f57-0c1d2e3f4a5b",
  "title": "Business Card",
  "author": "customer-1001",
  "product": { "id": "sku-123", "ref": "cart-line-7f3a" },
  "pdf": "https://pdf.print.app/project_2b6f1c9e-8d0a-4c3e-9f57-0c1d2e3f4a5b",
  "png": "https://png.print.app/project_2b6f1c9e-8d0a-4c3e-9f57-0c1d2e3f4a5b",
  "jpeg": "https://jpeg.print.app/project_2b6f1c9e-8d0a-4c3e-9f57-0c1d2e3f4a5b",
  "tiff": "https://tiff.print.app/project_2b6f1c9e-8d0a-4c3e-9f57-0c1d2e3f4a5b",
  "created": "2026-10-17T09:12:03Z",
  "modified": "2026-10-17T09:12:03Z",
  "pages": [ … ],
  "metadata": { … },
  "settings": { … }
}

author is the userId your page passed to the editor, if any. product is the product object your page passed, or null. The pdf, png, jpeg and tiff links render the file from the project’s current state when you request them. File uploaded

{
  "id": "file_01JABCDEF….png",
  "size": 482113,
  "contentType": "image/png",
  "created": "2026-10-17T09:14:55Z",
  "url": "https://…",
  "thumbnail": "https://…"
}

url is a download link that expires after one hour.

Delivery

You can enter several URLs for an event, separated by commas. Each one receives every event.
Each event is sent once. Failed deliveries are not retried, so make your endpoint answer quickly with a 2xx. In rare cases an event can arrive twice, so ignore a PrintApp-Event-Id you have already handled.
With signing on, your server can reject anything that isn’t from Print.App. Without it, confirm a project with the REST API before you act on it: a 200 there confirms the project is yours.

Verify a signature

Signing is off until you turn it on. Once it’s on, every webhook carries a PrintApp-Signature header that proves it came from Print.App and was sent recently. Turn it on: in the Print.App admin, open Domains, expand your current domain, click Manage next to Secret keys, then Create signing secret under Webhook signing. Copy the secret (whsec_…) to your server. You can reveal it again there later. The header looks like this:

PrintApp-Signature: t=1760693523,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd

t is when the webhook was sent, in Unix seconds. v1 is the hex HMAC-SHA256 of t, a full stop and the raw request body, keyed with your secret. To verify:

Read the raw request body, before any JSON parsing. Re-serialized JSON won’t match.
Compute the HMAC of <t>.<raw body> and compare it with each v1, in constant time.
Reject the request if no v1 matches, or if t is more than 5 minutes from your clock. The time check stops an old request being replayed.

import crypto from 'node:crypto';

function verifyPrintAppSignature(rawBody, header, secret, toleranceSeconds = 300) {
	const parts = (header || '').split(',').map(part => part.split('='));
	const timestamp = Number(parts.find(([key]) => key === 't')?.[1]);
	const signatures = parts.filter(([key]) => key === 'v1').map(([, value]) => value);
	if (!timestamp || Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) return false;

	const expected = crypto.createHmac('sha256', secret).update(`${timestamp}.${rawBody}`).digest('hex');
	return signatures.some(signature => signature.length === expected.length &&
		crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)));
}

// Express: keep the body raw for this route
app.post('/webhooks/printapp', express.raw({ type: 'application/json' }), (req, res) => {
	if (!verifyPrintAppSignature(req.body.toString('utf8'), req.get('PrintApp-Signature'), process.env.PRINTAPP_WEBHOOK_SECRET))
		return res.sendStatus(400);
	const event = JSON.parse(req.body);
	res.sendStatus(200);
});

function verify_printapp_signature(string $rawBody, ?string $header, string $secret, int $tolerance = 300): bool {
    if (!$header) return false;
    $timestamp = 0;
    $signatures = [];
    foreach (explode(',', $header) as $part) {
        [$key, $value] = array_pad(explode('=', $part, 2), 2, '');
        if ($key === 't') $timestamp = (int) $value;
        elseif ($key === 'v1') $signatures[] = $value;
    }
    if (!$timestamp || abs(time() - $timestamp) > $tolerance) return false;

    $expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    foreach ($signatures as $signature) {
        if (hash_equals($expected, $signature)) return true;
    }
    return false;
}

$rawBody = file_get_contents('php://input');
if (!verify_printapp_signature($rawBody, $_SERVER['HTTP_PRINTAPP_SIGNATURE'] ?? null, getenv('PRINTAPP_WEBHOOK_SECRET'))) {
    http_response_code(400);
    exit;
}
$event = json_decode($rawBody, true);

import hashlib
import hmac
import time


def verify_printapp_signature(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    if not header:
        return False
    parts = [part.split("=", 1) for part in header.split(",") if "=" in part]
    timestamp = next((value for key, value in parts if key == "t"), "")
    signatures = [value for key, value in parts if key == "v1"]
    if not timestamp.isdigit() or abs(time.time() - int(timestamp)) > tolerance:
        return False
    expected = hmac.new(secret.encode(), timestamp.encode() + b"." + raw_body, hashlib.sha256).hexdigest()
    return any(hmac.compare_digest(expected, signature) for signature in signatures)


# Flask: request.get_data() is the raw body
# verify_printapp_signature(request.get_data(), request.headers.get("PrintApp-Signature"), secret)

Rolling the secret: click Roll secret. The new secret starts signing at once, and the previous one keeps signing alongside it for 24 hours, so the header carries two v1 values. Update your server within that day; the code above accepts either. Stop signing deletes the secret and sends webhooks unsigned again.

Getting Started

Configuration

Platforms

Print Options

Gang Sheet Builder

Template Studio

About Webhooks

Setting up a Webhook

Payloads

Delivery

Verify a signature

​About Webhooks

​Setting up a Webhook

​Payloads

​Delivery

​Verify a signature

About Webhooks

Setting up a Webhook

Payloads

Delivery

Verify a signature