Outbound webhooks push membership events to any URL you own — Zapier, Make, a CRM, or your own backend — in real time. Deliveries are signed, retried on failure, and logged with the response code of every attempt.
Where: WP Admin → Tiger Membership → Settings → Webhooks & API. Tier: Pro.
Creating an endpoint
Click Add Endpoint, paste the destination URL, choose which events to subscribe to (or the * wildcard for all), and save. A 40-character shared secret is generated automatically and used to sign every delivery to that endpoint. Endpoints can be toggled Active / Inactive — an inactive endpoint receives nothing.
Events
Membership emits these lifecycle events. Subscribe to any subset, or to * for everything:
member.created,member.activated,member.trial_endingmember.paused,member.resumed,member.cancelled,member.expiredmember.upgraded,member.downgradedpayment.succeeded,payment.failed
Payload & signature
Each POST body is JSON shaped as { event, data, emittedAt }, where emittedAt is an ISO-8601 timestamp. Two headers identify it:
| Header | Meaning |
|---|---|
X-Tiger-Event |
The event name (e.g. member.cancelled) |
X-Tiger-Signature |
sha256=<hmac> — HMAC-SHA256 of the raw body using your endpoint secret |
Verify by computing 'sha256=' . hash_hmac('sha256', $rawBody, $secret) and comparing it (constant-time) to the X-Tiger-Signature header.
Retries & redelivery
A failed delivery (a non-2xx response, a timeout, or a connection error) is retried automatically on a backoff schedule — roughly 1, 5, 15 and 30 minutes — up to 5 attempts total. Each retry resends the identical signed body, so signatures and idempotency keys stay stable. Every attempt is written to the delivery log (open it via Deliveries on the endpoint row) with its HTTP status, and you can Redeliver any past delivery manually — a redeliver reuses the stored payload and is logged as a fresh attempt.
Troubleshooting
My endpoint isn’t receiving anything.
Confirm the endpoint is Active, that it subscribes to the event you expect (or *), and that your license is Pro — webhook delivery is gated to Pro. Then check the Deliveries log for attempts and their response codes.
Signature verification keeps failing.
Hash the raw request body (not a re-encoded copy), prefix your computed HMAC with sha256=, and compare against the full header value. Any reserialization of the JSON will change the bytes and break the check.
Deliveries stopped retrying.
Retries stop after 5 attempts or if the endpoint is deleted or set to Inactive between attempts. Fix the receiver, then use Redeliver on the last logged delivery to resend.