Skip to content
privatenpmREGISTRY
Start free trial
Menu

Configure private registry webhooks

Send package and access-key change notifications to your own HTTPS endpoint and verify each delivery before acting on it.

Subscribe to registry changes

On Growth and higher plans, open Settings → Webhooks and add your HTTPS receiver. Subscribe to the event types you need, such as npm_package.published, npm_package.unpublished, registry_download_key.created, registry_download_key.updated, and registry_download_key.revoked. Use * only when your receiver can safely ignore future event types.

Webhook endpoint form with HTTPS URL and npm package event choices
Select the package and download-key events your receiver handles.

Verify and test delivery

  1. Store the endpoint's signing secret on your server. Verify the Standard Webhooks webhook-id, webhook-timestamp, and webhook-signature against the raw request body before parsing it.
  2. Use Send test event on the endpoint page, then inspect its delivery history and your receiver logs.
  3. Deduplicate business effects by organization and event ID. A delivery can retry, and events can arrive out of order.

The payload identifies a resource and action; it does not contain package contents, customer details, or download-key secrets. The API reference covers resource lookups, and the sales automation guide covers the separate inbound payment event flow.

READY WHEN YOU ARE

Put private packages to work.

Start 30-day trial