Skip to main content
BugViper receives GitHub webhook events to trigger code reviews and track PR activity. These endpoints are called by GitHub, not by you directly — but you need to configure them when setting up the GitHub App. Once registered, GitHub will POST event payloads to BugViper automatically whenever pull request activity occurs in your connected repositories.
These endpoints are public and do not require Firebase authentication. They are secured instead via HMAC-SHA256 signature verification — GitHub signs every payload with your configured webhook secret, and BugViper rejects any request whose signature does not match.

​
POST /api/v1/webhook/onComment

The main webhook receiver for all GitHub PR and repository events. When BugViper receives a valid payload on this endpoint, it inspects the event type and dispatches the appropriate action — queuing a code review, updating PR state, or handling an app installation. Authentication: GitHub HMAC-SHA256 signature delivered in the X-Hub-Signature-256 request header. BugViper validates this signature against your configured webhook secret before processing any payload.

​
Handled Event Types

​
Bot Commands

When an issue_comment event arrives, BugViper checks whether the comment contains a recognized command:

​
Configuration

Set this URL as the Webhook URL in your GitHub App settings:

​
POST /api/v1/webhook/marketplace

Receives GitHub Marketplace purchase and subscription lifecycle events. BugViper uses these events to update account plan status in response to Marketplace activity. Authentication: GitHub HMAC-SHA256 signature delivered in the X-Hub-Signature-256 request header. BugViper validates this signature against your configured Marketplace webhook secret before processing any event.

​
Handled Event Types

​
Webhook Setup

Follow these steps to register BugViper’s webhook with your GitHub App:
1

Open your GitHub App settings

Go to GitHub → Settings → Developer settings → GitHub Apps and select your BugViper app.
2

Set the Webhook URL

In the Webhook section, enter your BugViper webhook URL:
3

Set the Webhook Secret

Enter a strong random string in the Webhook secret field and save the same value in your BugViper deployment configuration. GitHub uses this secret to sign every outbound payload with HMAC-SHA256, and BugViper uses it to verify authenticity before processing.
4

Select the required events

Under Subscribe to events, enable the following:
  • Issue comments
  • Pull requests
  • Pushes
  • Installations
  • Pull request review threads
5

Save your changes

Click Save changes. GitHub will immediately begin delivering matching events to your webhook URL. You can verify delivery in the Recent Deliveries tab of your GitHub App settings.
During local development, use a tool like ngrok to expose your local server to the internet and receive live GitHub webhook payloads for testing.