Zapier & Webhooks

What are webhooks

A webhook is an HTTP POST request sent from Stirling-QR to a URL of your choice whenever a specified event occurs. The most common trigger is 'on_scan' — fired every time a QR code in your organisation is scanned. You can also trigger on 'on_expire' and 'on_limit_reached'.

Setting up a webhook

Go to Dashboard → Settings → Webhooks. Click 'Add Webhook'. Enter the URL Stirling-QR should POST to, select the events to trigger on, and save. You will receive a signing secret — use it to verify that requests genuinely come from Stirling-QR.

Webhook payload format

Every webhook POST contains a JSON body with the event name, timestamp, QR code details (id, name, slug, destination), and scan details (country, city, device, browser, OS).

{
  "event": "on_scan",
  "timestamp": "2026-03-21T12:00:00Z",
  "qr_code": { "id": "...", "name": "Summer Flyer", "slug": "summer" },
  "scan": { "country": "GB", "city": "London", "device": "mobile" }
}

Connecting to Zapier

Use Zapier's 'Webhooks by Zapier' trigger (catch hook) as your webhook URL. When a QR code is scanned, Zapier receives the payload and you can route the data to any of Zapier's 5,000+ connected apps — Google Sheets, Slack, HubSpot, Salesforce, Airtable, and more.

Verifying the signature

Every webhook request includes an X-Stirling-QR-Signature header containing an HMAC-SHA256 hash of the request body signed with your webhook's secret. Verify this signature in your receiving endpoint to ensure the request is genuine.