How to Get Signed Webhooks When an X Account Posts

Why monitors beat DIY polling

DIY means cron + timeline fetch + dedupe + retries + secrets. XFlux account monitors poll on a schedule (down to 1s on Starter+), store hits in the Dashboard, and — on paid plans — POST signed JSON to your HTTPS URL when something new matches.

Free tier includes 1 monitor with hit history. Live delivery of new hits requires Starter ($19/mo) or higher. You can still save a webhook URL and send test pings on Free.

Setup (Dashboard)

1. Create an account and open Dashboard → Monitors. 2. Add a target @username and optional comma-separated keywords. 3. Expand Webhook, paste an HTTPS endpoint, save. 4. Copy the signing secret shown once. 5. Click Test webhook.

Product overview: /twitter-webhook. Make.com step-by-step: /docs/integrations/make. Full field reference: /docs/webhooks.

Payload and headers

On a hit, XFlux sends Content-Type application/json with X-XFlux-Event, X-XFlux-Timestamp, and X-XFlux-Signature (sha256=…). Event name is monitor.hit. Test deliveries use monitor.test.

POST https://your-server.com/webhooks/xflux
Content-Type: application/json
X-XFlux-Event: monitor.hit
X-XFlux-Timestamp: 1710000000
X-XFlux-Signature: sha256=<hex>

{
  "event": "monitor.hit",
  "monitor": {
    "id": "clx...",
    "targetUsername": "elonmusk",
    "keywords": null
  },
  "tweet": {
    "id": "1234567890",
    "text": "Hello world",
    "authorUsername": "elonmusk",
    "createdAt": "2026-06-14T12:00:00.000Z"
  },
  "detectedAt": "2026-06-14T12:00:05.000Z"
}

Verify HMAC-SHA256

Compute HMAC-SHA256 over `{timestamp}.{raw_body}` with your webhook secret. Compare to X-XFlux-Signature with a timing-safe equal. Reject timestamps older than about five minutes. Always use the raw body bytes — parsed-then-restringified JSON will break verification.

import crypto from "crypto";

function verify(secret, timestamp, rawBody, signatureHeader) {
  const expected =
    "sha256=" +
    crypto
      .createHmac("sha256", secret)
      .update(`${timestamp}.${rawBody}`)
      .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  );
}

Route with Make.com (or your bot)

Paste a Make.com Custom Webhook URL into the monitor. Make can fan out to Slack, Telegram, Discord, Sheets, or HTTP modules. For Discord specifically, see /twitter-discord-alerts.

Failed deliveries are logged in the Dashboard; the current product does not auto-retry — fix the endpoint and use Test webhook.