ClickBank Webhook MCP Server

ClickBank Webhook

ClickBank Instant Notification Service (INS) pushes one server-to-server POST per account event — sales, rebills, refunds, chargebacks, subscription changes, cart abandonment, and test pings. Each POST is one stored report. Tools read what already landed; there is no pull API and no way to replay or mutate ClickBank state from here.

Wire shape in storage

INS arrives as HTML form fields normalized to flat JSON in export.json. Current INS (version 8.x) wraps the transaction in an encrypted envelope — stored deliveries usually expose two top-level keys:

• notification — AES-256-CBC ciphertext of the transaction JSON (not human-readable on its own).
• iv — initialization vector paired with that ciphertext.

When the connection stores a ClickBank INS secret key, ingest decrypts before storage and export.json holds the inner transaction object directly. Without that key, only the encrypted envelope is stored — read ## This connection for decryption context; do not invent transaction fields.

The decrypted inner body is JSON. Field visibility depends on your role in the transaction (VENDOR, AFFILIATE, or JV_UPSELL): vendor-only blocks such as full customer shipping/billing, some totals, and vendorVariables may be absent for affiliate-role notifications.

Decrypted payload layout (version 8.x)

When the inner JSON is available (already decrypted upstream or surfaced via connection notes), expect grouped fields:

Header / transaction

• transactionTime — upstream event time (ISO 8601); prefer over source.captured_at when both exist.
• receipt — stable ClickBank receipt id; use for deduping retries.
• transactionType — event kind. Common values: SALE (initial sale), BILL (rebill), RFND (refund), CGBK / INSF (chargebacks), CANCEL-REBILL / UNCANCEL-REBILL, SUBSCRIPTION-CHG, ABANDONED_ORDER, TEST / TEST_SALE / TEST_BILL / TEST_RFND and related test variants.
• vendor, affiliate, role
• totalAccountAmount — USD amount credited to your account on this notice.
• totalOrderAmount, totalTaxAmount, totalShippingAmount, currency, paymentMethod, orderLanguage
• trackingCodes — array of vendor/affiliate tracking strings from the order form.
• declinedConsent — GDPR marketing consent (EU initial sales; vendor role).
• version, attemptCount — INS version and delivery retry count.

Line items — lineItems[]

Each element describes one purchased SKU: itemNo, productTitle, productPrice, productDiscount, affiliatePayout, jvPayout, taxAmount, shippingAmount, accountAmount, quantity, recurring, shippable, lineItemType (ORIGINAL, CART, BUMP, UPSELL), and vendor-only downloadUrl.

Customer — customer (vendor role)

Nested shipping and billing objects with name, email, phone, and address subfields.

Upsell — upsell

upsellOriginalReceipt, upsellFlowId, upsellSession, upsellPath when the sale came through an upsell path.

Tracking (version 8.x)

• commonTrackingParameters — device, browser, OS, clickId, clickTimestamp, trackingType, cbPage, etc.
• affiliateTrackingParameters — affiliate-only hop metadata: trafficType, trafficSource, campaign, offer, ad, adgroup, creative, affSub1–affSub5, uniqueAffSub1–uniqueAffSub5, extclid, fbclid.

Seller passthrough — vendorVariables

Custom payment-link variables as v1, v2, … when the vendor configured them.

First moves

1. Latest report — default for “what sale or refund just came in”.
2. Check envelope vs decrypted body — if only notification / iv appear, say the payload is still encrypted and consult connection notes before quoting buyer or payout fields.
3. Read transactionType + receipt — classify the event and dedupe against recent history.
4. Recent reports — audit volume, duplicate receipts, or missing rebills/refunds.
5. One report by id — after listing, when the user names a specific receipt or delivery.

Response shape

• export.json — normalized POST body (flat envelope or decrypted transaction object).
• export.text — raw body when JSON parsing is not used.
• source.captured_at — when the POST landed here (not necessarily transactionTime).

Operational order

1. Start with the latest report — do not guess a report id.
2. If captured_at is older than expected, say so — ClickBank sends on their event schedule and may retry failed deliveries (watch attemptCount and duplicate receipt values).
3. List recent reports only for history, duplicate suspicion, or explicit compare-by-date asks.
4. Read ## This connection in the skill supplement for account role, INS version, and decryption context.

Gotchas

• Read-only — cannot refund, cancel rebills, or acknowledge INS from here.
• Encrypted by default — modern INS stores ciphertext at the top level; treat inner JSON field names above as the schema after decryption, not as guaranteed keys in every stored file.
• Role-filtered fields — affiliate notices omit many vendor/customer blocks; do not infer missing PII was never collected.
• Currency — amounts in the decrypted JSON are USD unless currency says otherwise on vendor notices.
• Subscription changes — SUBSCRIPTION-CHG may encode SKU transition in the transactionType string (SKU old->new); line items reflect the original product.
• Legacy INS — older unencrypted parameter names (ctransaction, cproditem, …) may appear on very old integrations; prefer modern JSON keys when both exist.
• Empty — no stored reports means nothing has arrived yet.