A simple Bearer token
No OAuth and no app registration: Authorization: Bearer crossly_live_… The crossly_live_ and crossly_test_ prefixes are easy to spot in logs.
Crosslybot feature
Webhook API: REST cross-posting to Telegram, VK, Max, OK
One POST request — and the post goes to every target of the project: Telegram, VK, Max and Odnoklassniki. An incoming webhook accepts posts from your systems, an outgoing one sends posts out.
- a post to every project target
- 1 request
- a post to every project target
- result kept per Idempotency-Key
- 24 h
- result kept per Idempotency-Key
- incoming webhook; outgoing from Standard
- Pro+
- incoming webhook; outgoing from Standard
The Webhook API is Crosslybot’s open platform for developers and AI agents. Instead of separate integrations with the Telegram Bot API, VK API, Max API and the Odnoklassniki API, you send one HTTP request — and the post is published to every target of the project with all of its settings.
The API works the way developers expect: a Bearer token, Idempotency-Key, entities in Telegram format, token prefixes and a sandbox for checks. The outgoing webhook works the other way round — it sends the project’s posts to your server with an HMAC signature.
Who it is for
- AI agents and copywriters using GPT/Claude — automatically publish generated content to your channels
- No-code teams on n8n, Make, Zapier — an HTTP node for publishing to social networks
- Content teams with a Notion calendar — status “Ready” → automatic publishing
- News aggregators and RSS projects — collect from many sources and publish to your channels
- Developers of custom services — a simple way to post from your own backend
Guides
How it works
- 1
Create a webhook
In the app, create an incoming webhook and connect it to a project as a source. The token is shown once — save it.
- 2
Test in the sandbox
POST /v1/sandbox/test validates the payload without publishing — available on every plan.
- 3
Send a post
POST https://wh.crosslybot.ru/v1/webhooks/{slug} with an Authorization: Bearer header and JSON: text, entities, media, buttons.
- 4
Watch the history
The webhook section shows the request history: what was accepted, what was rejected and why.
What you get
Telegram-style entities
The incoming webhook accepts text with entities (offset/length/type) — the Telegram Bot API format. Crosslybot converts the markup for VK, Max and Odnoklassniki itself. The outgoing webhook sends text and entities in the same format.
Idempotency-Key
Pass an Idempotency-Key header or external_id — a retry with the same key within 24 hours returns the saved response instead of a new post.
Sandbox for testing
POST /v1/sandbox/test validates the payload without publishing: Free — 100 checks a day, Mini — 1000, Standard and up — unlimited.
A separate domain
The public API lives on wh.crosslybot.ru — separate from the app, with its own limits.
Signed outgoing calls with retries
Posts are delivered to your URL with an HMAC-SHA256 signature. If your server does not respond, delivery is retried up to 5 times with growing intervals.
FAQ
Which plans include the Webhook API?
The incoming webhook (accepting posts from your systems) is on Pro, Maxi and Business. The outgoing one (sending posts out) starts from Standard. The sandbox is on every plan, including Free. Compare plans on the pricing page.
Why is this easier than working with platform APIs directly?
One endpoint instead of separate integrations with Telegram, VK, Max and Odnoklassniki. On top of that you get everything a project can do: AI translation and style in targets, delays and pauses, the publishing queue and Operations.
Can I send from n8n, Make or Zapier?
Yes, any HTTP client works: HTTP Request in n8n, the Make HTTP module, Webhooks in Zapier. Step by step — in the n8n integration guide.
What are the rate limits?
Four levels: a minimum interval between requests (10 seconds by default, adjustable from 1 to 60), burst protection, an hourly quota per plan (Pro — 100, Maxi — 300, Business — 1000 requests per hour) and a soft block: after 5 violations within an hour the webhook is turned off and has to be turned back on manually.
How are requests protected?
The token is stored as a hash and shown only once. Media links must be https:// and are protected against requests into internal networks. Optionally — an IP allowlist, request timestamp checks and a sender HMAC signature. Outgoing requests are signed with HMAC-SHA256.
Can I control pauses via the API?
Yes: the temp-pause and temp-resume methods set and lift a pause for the project or its targets. The /info request returns the list of projects and targets — the MCP server for AI agents is built on it.
Where is the documentation?
Start with the cURL quick start and the REST API reference. An overview is on the Webhook API page.
Related features
DEV PRO+ PRO+
Webhook API
REST API for servers, n8n and your own integrations. One HTTP request — a post in Telegram, VK, Max and OK. Bearer token, Idempotency, sandbox, HMAC-signed outbound.
Learn moreMCP server
Connect Claude Desktop, Cursor or Cline and publish posts using natural language. Hosted server, targets resolved by name, no local install.
Learn moreScheduled pause
Pause the whole project or a single channel — manually or on a weekly schedule. Posts pile up and go out one minute apart.
Learn more
Free plan
Ready to try?
Connect the bot in 2 minutes. Free plan — no cards, no signup.
