SaySift Feedback API: REST Endpoints and Webhooks

July 31, 2026

The widget covers the common case — a script tag, a form, a submission. If you need to submit feedback from your own backend, a support tool, or a script instead of a browser widget, SaySift exposes that as a plain REST API.

Submitting from the browser (public key)

POST /api/v1/feedback accepts a public key the same way the widget does — safe to call from client-side code:

curl -X POST https://saysift.com/api/v1/feedback \
  -H "Content-Type: application/json" \
  -d '{
    "projectKey": "pk_live_...",
    "type": "bug",
    "title": "Checkout fails on Safari",
    "description": "Payment step throws a 500 on iOS Safari 17."
  }'

This is rate-limited and origin-checked the same way the widget's submissions are, since it's meant to be reachable from a browser.

Submitting from your server (secret key)

POST /api/v1/server/feedback takes a secret key as a bearer token instead of a project key in the body — use this from your backend, not from client-side code:

curl -X POST https://saysift.com/api/v1/server/feedback \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "type": "idea",
    "title": "Bulk CSV export",
    "description": "Customer asked for this via support chat."
  }'

This is the path for piping feedback in from a support inbox, a Slack bot, or an internal tool — anywhere the submission doesn't originate from a browser session.

Webhooks

Each project can configure one webhook destination. When a feedback item's status changes, SaySift sends a signed POST to that URL with two headers: X-SaySift-Event (the event type) and X-SaySift-Signature (an HMAC signature of the payload using your webhook secret). Verify the signature before trusting the payload — the secret is shown once when you generate it, in the project's settings page.

Public keys vs secret keys

Public keys (pk_live_...) are safe in browser code — they're scoped to accepting submissions, nothing else. Secret keys (sk_live_...) belong only on a trusted server. Both are generated per-project, and both can be revoked without affecting the other.

Full request/response shapes and status codes are documented at the widget docs.

If you're integrating from a specific framework rather than raw HTTP, see React Feedback Widget, Next.js Feedback Widget, or Vanilla JavaScript.

Start for free — no credit card required.