Prepare your channel destination
For Slack, create or select an app in your workspace, enable Incoming Webhooks, then add a webhook to the workspace. Choose the destination channel and review the authorization before approving it. Copy the resulting URL into your relay's secret configuration.
For Discord, open Server Settings, then Integrations, and create a webhook. Give it a name, choose the text channel and copy its URL into your relay's secret configuration. Ask your workspace or server administrator if you do not have the required access.
Treat either URL as a secret. It is the relay's outbound destination, not the receiver URL you will save in Vouched. The providers' official instructions below cover their current setup screens.
Choose the events that need attention
An owner can add a public HTTPS event receiver in Developers. Available selections are submission.approved, submission.rejected, payout.paid and campaign.settled. These are shared brand-level destinations.
Application alerts, payment-failure webhooks and scheduled campaign digests are not currently offered in this connection form. Selecting an event does not create or simulate the business event.
- Create a receiver in your backend or an automation service that can validate the signature and map the payload.
- Add its public HTTPS URL and a recognizable label in Developers.
- Select the events you need, add the endpoint and securely store the signing secret shown once.
Use a relay for channel messages
Do not paste a Slack or Discord incoming-webhook URL directly into Vouched. Vouched sends its own event JSON, not the native message format those services expect.
Your receiver verifies the Vouched request, converts the event into a short message and sends it through your Slack or Discord integration. An automation service such as Make or Zapier is an option only if your workflow can securely validate the incoming request before acting on it.
Start with a private test channel. Include the event name and an appropriate dashboard link, not private creator details, secrets or a full payment record. Channel membership is a separate access decision from membership in Vouched.
Verify before processing
Read the raw request body before parsing JSON. X-Vouched-Timestamp is the Unix timestamp in seconds. X-Vouched-Signature has the form sha256=<hex digest>.
Compute HMAC-SHA256 with your endpoint secret over timestamp + '.' + rawBody. Compare the expected digest in constant time, and reject missing or malformed headers and timestamps more than five minutes in the past or future.
After signature verification, validate the event payload against your allowlist. Accept only the events you configured. Make processing idempotent: a retry must not duplicate your downstream action. Use the event and relevant record identifiers to deduplicate transitions; X-Vouched-Attempt is an attempt counter, not a unique event ID.
POST /your-vouched-receiver
Content-Type: application/json
X-Vouched-Event: submission.approved
X-Vouched-Timestamp: <unix-seconds>
X-Vouched-Signature: sha256=<hmac-hex>
X-Vouched-Attempt: <attempt-number>Test both halves of the connection
Select Test on the saved endpoint. This queues a test; it does not prove delivery. The worker must run, the receiver must accept the request and your relay must successfully post to the channel.
Check the endpoint's last status, last delivery and failures in Developers, then check the receiver and channel separately. A 2xx from your receiver confirms acceptance there, not that Slack or Discord displayed a message.
For a missing update, check the selected event, endpoint activity, worker delivery status, signature verification, receiver logs and channel credentials in that order. Remove an unused endpoint. Native one-click Slack/Discord connection and scheduled digests remain unavailable.
Common questions
Is Test connection proof that Slack received the message?
No. A queued test and a successful receiver response are separate from the relay's successful delivery to Slack or Discord.
Will adding an endpoint enable events not listed here?
No. Only the four supported event types can be delivered. A receiver cannot create missing Vouched event triggers.
Need a hand?
Use Feedback in your dashboard if a guide does not answer your question. Include the page, what you expected and what happened. Never include a password, API key, account number or private payload.
Open API & connections