Analytics Destinations

Destinations streams every Update Center, Demo Center, and subscriber interaction to a webhook you control, near real time. Pipe DemoBites engagement into your warehouse, CDP, CRM, or alerting, no polling, no export jobs.

How Destinations works

As visitors browse your Update Center and Demo Center, watch videos, click CTAs, search, and subscribe, DemoBites records those interactions. Destinations forwards them to your own HTTPS endpoints as signed JSON batches, typically within about a minute of the interaction. You choose exactly which events each endpoint receives from a 26-event catalog.

You’ll find it in Analytics, the Destinations control sits on its own, to the right of the view switcher. Only workspace admins can configure endpoints.

Adding an endpoint

Each workspace can have up to 3 endpoints, useful for separating, say, a production warehouse pipeline from a staging consumer or a Slack-alerting relay.

Choosing events

Subscription is per event, not all-or-nothing. The catalog holds 26 events in four groups, and the in-product picker documents when each one fires:

Event reference

The full catalog, every event name and when it fires.

Verifying signatures

Every delivery is signed with your endpoint’s secret so your receiver can prove it came from DemoBites. The signature travels in one header:

X-DemoBites-Signature: t=<unix>,v1=<hex>

t is the Unix timestamp of the delivery, andv1 is HMAC-SHA256(secret, t + “.” + rawBody) as hex. Compute the same HMAC over the raw request body exactly as received, then compare with a timing-safe comparison:

import { createHmac, timingSafeEqual } from "node:crypto";

// header: the X-DemoBites-Signature value, "t=<unix>,v1=<hex>"
// rawBody: the request body EXACTLY as received (don't re-serialize)
function verifySignature(header, rawBody, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((pair) => pair.split("="))
  );
  const expected = createHmac("sha256", secret)
    .update(parts.t + "." + rawBody)
    .digest("hex");
  return (
    expected.length === parts.v1.length &&
    timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1))
  );
}

Verify against the raw body bytes, parsing and re-serializing the JSON first will change the string and break the signature. As an extra replay guard, you can reject deliveries whose t is older than your tolerance.

Payload envelope

Deliveries are HTTPS POSTs of a JSON object with a single events array, batching up to 50 events per delivery. Every event carries the same envelope:

A realistic two-event batch:

{
  "events": [
    {
      "event_id": "evt_01j9wxr8q4nd6t",
      "event": "update_video_progress",
      "occurred_at": "2026-08-04T14:07:31Z",
      "schema_version": 1,
      "workspace": { "id": 4821, "slug": "acme" },
      "source": "update_center",
      "page": "/updates/summer-release",
      "session_id": "b3c9e2a4-5f7d-4c1e-9a2b-8d4f6e1c0a73",
      "context": {
        "referrer_host": "news.ycombinator.com",
        "utm": { "utm_source": "newsletter" },
        "country": "DE"
      },
      "properties": { "progress": 50 }
    },
    {
      "event_id": "evt_01j9wxz2k7rtq8",
      "event": "subscriber_created",
      "occurred_at": "2026-08-04T14:08:02Z",
      "schema_version": 1,
      "workspace": { "id": 4821, "slug": "acme" },
      "source": "update_center",
      "page": "/updates",
      "session_id": "b3c9e2a4-5f7d-4c1e-9a2b-8d4f6e1c0a73",
      "context": {
        "referrer_host": null,
        "utm": null,
        "country": "DE"
      },
      "properties": {
        "email": "dana@example.com",
        "consent": {
          "granted_at": "2026-08-04T14:08:02Z",
          "source": "update_center"
        }
      }
    }
  ]
}

Illustrative values. The exact properties each event carries are documented alongside it in the event picker.

Delivery semantics

Respond with a 2xx status promptly, anything else (or a timeout) counts as a failed delivery and enters the retry schedule.

Availability