Use the app’s Integrations webhook editor to connect an authorized receiving service. Prepare that service before creating an endpoint, store the displayed signing secret privately and treat an interrupted creation or rotation as an outcome to reconcile.
These instructions follow the Android app version 1.0.46, build 272. Available actions depend on your account permissions and current service state. Other installed versions may present different controls.
1. Prepare the receiver and permission
- Use an account with the required account-webhook access; CRM access alone is different.
- Deploy the final receiving HTTPS route and confirm it accepts the intended webhook workflow.
- Choose the smallest event set your application needs.
- Prepare secure secret storage and signature verification using the existing webhook guide.
A browser-openable URL is not proof that the receiver verifies signatures or processes events correctly. Keep the receiving application’s event deduplication and processing logs separate from the Portal’s delivery acknowledgements.
2. Enter the final endpoint details
Open Integrations → Webhooks and use the creation action. Enter a recognizable label, the final URL and the intended event subscriptions. Review the complete form before saving. Do not use a redirecting URL and assume delivery follows it.
For an existing endpoint, the reviewed app updates its label, enabled state and event subscriptions; changing its URL is a separate replacement-endpoint workflow. Do not promise that editing the label moves deliveries to another server. Review any applicable SMS sender scope in the account’s supported configuration as well.
3. Create once and store the secret
- Submit the reviewed endpoint once and wait for the result.
- When the signing secret is displayed, copy it directly into your approved secret store.
- Configure the receiver with that endpoint’s secret.
- Reopen the endpoint list and confirm its label, URL, subscriptions and enabled state.
The signing secret is not the account API key. Do not paste it into a query string, screenshot, source repository or ordinary ticket. Do not assume the complete secret can be displayed indefinitely after you dismiss the handoff.
4. Reconcile an interrupted creation
The app retains a pending-operation identity for a creation intent. This helps it reuse the same request identity when the same creation is retried after an uncertain result. It is not a promise that the whole form or secret will always be restored automatically.
- Reload the endpoint list and look for the intended saved endpoint.
- Compare its actual URL and event scope before creating another one.
- If the original outcome remains uncertain, keep the same intended details and follow the supported retry or Support path.
- Do not change the label or URL merely to force a second request past an unresolved operation.
A conclusive rejection and a lost server response have different recovery paths. If the endpoint exists but the secret was not retained, coordinate a deliberate secret rotation with the receiver instead of assuming repeated creation recovers the old secret.
5. Rotate only when the receiver is ready
Open the correct endpoint, choose Rotate secret and read the confirmation. The app tracks rotation against that endpoint. Capture the returned secret privately and update the receiver. If interrupted, inspect the endpoint and operation outcome before starting another rotation; a second rotation can invalidate the credential you were trying to recover.
6. Verify a later delivery
Match an eligible later event with its endpoint and delivery log, then confirm signature verification and application processing on the receiver. A 2xx acknowledgement does not prove downstream work completed. Do not repeat a paid call or SMS solely to generate documentation evidence. For failures, provide Support the endpoint label, event reference, time and sanitized HTTP result without secrets.
Related guides
Reviewed 13 October 2026 against the current IllyVoIP controls, implementation and applicable references. Available options depend on account permissions and service state.