How to Integrate Replit with Podia

Podia provides a personal API token that you use as a bearer token on all API requests. To find it, log in to your Podia account and go to Settings (gear icon in the top navigation). Click on the Integrations tab. Scroll down to the API section — you will see your API token displayed there. If it has never been generated, click Generate API Token to create one. Copy the token value immediately and store it somewhere secure (like a password manager). Podia may not show the full token again after you navigate away — if you lose it, you can regenerate a new one, but this will invalidate any previously configured integrations using the old token. Note that the Podia API is still relatively limited compared to platforms like Stripe or HubSpot. It provides read access to products, customers, and orders, but not all operations are writable via API. The more powerful real-time integration path is through Podia's webhook system, which covers purchase events, refunds, and membership lifecycle events. The next step covers webhook configuration.

Open your Replit project. Click the lock icon (🔒) in the left sidebar to open the Secrets panel. Click + New Secret and create a secret named PODIA_API_TOKEN with your API token value. Also create PODIA_WEBHOOK_SECRET which you will use to verify incoming webhook signatures (you can set this to any random string now and use it when configuring the webhook in Podia in a later step). In Python, access the token with os.environ['PODIA_API_TOKEN']. In Node.js, use process.env.PODIA_API_TOKEN. After adding secrets, if your Repl is already running, stop and restart it to ensure the new environment variables are loaded. A quick way to test the token is to make a simple API call to the Podia products endpoint. A successful 200 response with your product list confirms the token is valid. A 401 Unauthorized response means the token is incorrect or has been regenerated in Podia.

1import os
2import requests
3
4API_TOKEN = os.environ['PODIA_API_TOKEN']
5
6headers = {
7    'Authorization': f'Bearer {API_TOKEN}',
8    'Accept': 'application/json'
9}
10
11# Test: fetch your Podia products
12response = requests.get('https://api.podia.com/products', headers=headers)
13
14if response.status_code == 200:
15    products = response.json()
16    print(f'API token valid. Found {len(products.get("data", []))} products.')
17    for p in products.get('data', []):
18        print(f'  - {p["name"]} ({p["type"]})')
19else:
20    print(f'API error: {response.status_code} — {response.text}')

Podia can POST webhook events to your Replit server when purchases, refunds, or membership events occur. This is the most powerful integration path because it gives you real-time data without polling. The server below handles incoming Podia webhook events. Podia sends a POST request with a JSON body containing the event type and associated data. Your server should respond quickly with a 200 status (within 10 seconds) and process the event asynchronously if needed. Podia webhook payloads include an event field (like purchase.completed or subscription.cancelled) and a data object with customer and product details. The example handles the most common events: purchase.completed (fires for one-time products), subscription.started (new membership), and subscription.cancelled (membership cancellation). For security, configure a webhook secret in Podia and verify the HMAC signature on incoming requests. The verification code below ensures only genuine Podia requests are processed.

1// Node.js Express webhook receiver for Podia
2const express = require('express');
3const crypto = require('crypto');
4const app = express();
5
6const WEBHOOK_SECRET = process.env.PODIA_WEBHOOK_SECRET;
7
8// Parse raw body for signature verification
9app.use('/webhook', express.raw({ type: 'application/json' }));
10app.use(express.json());
11
12function verifyWebhookSignature(rawBody, signatureHeader) {
13  if (!WEBHOOK_SECRET || !signatureHeader) return true; // skip if no secret configured
14  const expected = crypto
15    .createHmac('sha256', WEBHOOK_SECRET)
16    .update(rawBody)
17    .digest('hex');
18  return crypto.timingSafeEqual(
19    Buffer.from(expected, 'hex'),
20    Buffer.from(signatureHeader.replace('sha256=', ''), 'hex')
21  );
22}
23
24app.post('/webhook', (req, res) => {
25  const signature = req.headers['x-podia-signature'];
26  const rawBody = req.body;
27
28  if (!verifyWebhookSignature(rawBody, signature)) {
29    console.log('Invalid webhook signature — rejected');
30    return res.status(401).json({ error: 'Invalid signature' });
31  }
32
33  const event = JSON.parse(rawBody.toString());
34  console.log(`Received Podia event: ${event.event}`);
35
36  switch (event.event) {
37    case 'purchase.completed':
38      handlePurchase(event.data);
39      break;
40    case 'subscription.started':
41      handleNewMembership(event.data);
42      break;
43    case 'subscription.cancelled':
44      handleCancellation(event.data);
45      break;
46    default:
47      console.log(`Unhandled event type: ${event.event}`);
48  }
49
50  res.json({ received: true });
51});
52
53function handlePurchase(data) {
54  console.log(`New purchase: ${data.product?.name} by ${data.customer?.email}`);
55  // Add to email list, update CRM, send Slack notification, etc.
56}
57
58function handleNewMembership(data) {
59  console.log(`New membership: ${data.customer?.email}`);
60}
61
62function handleCancellation(data) {
63  console.log(`Cancelled membership: ${data.customer?.email}`);
64}
65
66app.get('/health', (req, res) => res.json({ status: 'ok' }));
67app.listen(3000, '0.0.0.0', () => console.log('Podia webhook server running on port 3000'));

With your Replit server running, you need to register your webhook endpoint in Podia. Log in to your Podia account and go to Settings > Integrations. Scroll to the Webhooks section and click Add Webhook. In the Endpoint URL field, enter your Replit server URL followed by /webhook — for example, https://your-repl-name.your-username.repl.co/webhook. If you are testing in development mode (not deployed), use the URL from the Replit webview preview. For production, use your Autoscale deployment URL. In the Secret field, enter the same random string you stored as PODIA_WEBHOOK_SECRET in Replit Secrets. Podia will use this to sign webhook payloads with HMAC-SHA256 so your server can verify they are genuine. Select the event types you want to receive. For most integrations, subscribe to purchase.completed, subscription.started, subscription.cancelled, and refund.issued. Click Save Webhook, then click Send Test Event to verify your server receives the test payload successfully. If the test event fails to reach your server, confirm your Replit server is running (not stopped), the URL is correctly formatted, and there are no typos in the endpoint path. The Replit webview URL is only available while the editor is open — for a reliable permanent URL, you need to deploy to Autoscale.

A permanent, always-on webhook endpoint requires deployment. Click the Deploy button in the top-right corner of the Replit editor. Choose Autoscale deployment. Set the run command to node index.js (Node.js) or python app.py (Python). Choose a machine with at least 0.25 vCPU and 256MB RAM — the Podia webhook server is lightweight. After deployment completes (30-60 seconds), Replit gives you a production URL. Update the webhook URL in Podia Settings > Integrations > Webhooks to use this permanent production URL instead of the development preview URL. Replit Secrets are automatically available in deployed Autoscale instances — you do not need to re-enter credentials after deployment. If you update a secret value, trigger a new deployment to apply the change. For production deployments serving real customers, add request logging to record all incoming webhook events with timestamps, so you have an audit trail for troubleshooting missed events or duplicate deliveries. Podia may retry failed webhooks, so your event handler should be idempotent — processing the same event twice should not create duplicate records.

1# Python Flask version of the Podia webhook receiver
2import os
3import hmac
4import hashlib
5from flask import Flask, request, jsonify
6
7app = Flask(__name__)
8WEBHOOK_SECRET = os.environ.get('PODIA_WEBHOOK_SECRET', '')
9
10def verify_signature(body, signature):
11    if not WEBHOOK_SECRET or not signature:
12        return True
13    expected = hmac.new(WEBHOOK_SECRET.encode(), body, hashlib.sha256).hexdigest()
14    return hmac.compare_digest(f'sha256={expected}', signature)
15
16@app.route('/webhook', methods=['POST'])
17def webhook():
18    signature = request.headers.get('X-Podia-Signature', '')
19    raw_body = request.get_data()
20
21    if not verify_signature(raw_body, signature):
22        return jsonify({'error': 'Invalid signature'}), 401
23
24    event = request.get_json(force=True)
25    event_type = event.get('event')
26    data = event.get('data', {})
27    print(f'Podia event: {event_type} | Customer: {data.get("customer", {}).get("email")}')
28
29    # Process event type
30    if event_type == 'purchase.completed':
31        product_name = data.get('product', {}).get('name')
32        print(f'New sale: {product_name}')
33
34    return jsonify({'received': True})
35
36@app.route('/health')
37def health():
38    return jsonify({'status': 'ok'})
39
40if __name__ == '__main__':
41    app.run(host='0.0.0.0', port=3000)