Timeglass Webhooks

A workspace registers one HTTPS URL. Timeglass syncs clients, projects and categories from your system once a day before timesheets are prepared, and sends approved time back, either as individual activities or as daily totals per person, day, project and category for timesheet, payroll, PSA and ERP systems. The endpoint (your adapter) translates between Timeglass and your system.

Set up

Set up an adapter at an https:// address, then a workspace admin adds it in Settings, Webhooks, Add endpoint. Timeglass then shows two secrets once: a bearer token (whtok_...) and a signing secret (whsec_...). They let your adapter tell real Timeglass requests apart from fake ones. Store them in your adapter's settings and check one of them on every request. Rotate secrets replaces both, and the old ones stop working right away. Send a test or preview the sync, then turn on the daily sync and sending approved time.

Requests

Every call is a signed JSON POST with X-Timeglass-Event, X-Timeglass-Delivery, X-Timeglass-Signature and Authorization: Bearer whtok_... headers. Events: ping, clients_and_projects.sync, time_entries.upsert, time_entries.delete, time_totals.upsert, time_totals.delete. Respond with 2xx to accept.

Verify requests

Check the bearer token, or the HMAC signature: t=<unix seconds>,v1=<hex>, where the hex is HMAC-SHA256 of <t>.<raw body> keyed with your signing secret. Reject timestamps more than five minutes old.

Starter adapter

A Node.js adapter that verifies the request, answers the sync, and creates, updates or deletes time records using the external_ref Timeglass sends back.

Retries, idempotency and limits

A failed time sync is retried with backoff for up to 10 attempts. One request per record is in flight at a time. HTTPS public URLs only, redirects are not followed, 60 second timeouts, 2 MB responses, 5,000 items per sync section, batches of up to 100 records.

Webhooks overview · Clients & projects sync · Time sync · REST API