--- title: "Netlify integration" description: "Add a Netlify deploy notification that calls Rookflare when a deploy succeeds, and your website is scanned right away. Setup, test and troubleshooting." url: "https://rookflare.com/integrations/netlify/" --- # Netlify integration Add an outgoing webhook for “Deploy succeeded” in Netlify, and each production deploy starts a Rookflare scan of your website. ## What the Netlify integration does ### What it does - Netlify’s HTTP POST deploy notification sends the deploy as JSON to Rookflare when the deploy succeeds. - Rookflare reads commit_ref from that JSON and uses it as the ref, so a retried deploy of the same commit starts one scan. - No build plugin and no change to netlify.toml; the notification lives in the project settings. ### Before you start - A Growth and Agency plan. The 14-day free trial runs on Growth, so you can set it up before you pay. - A verified website in Rookflare with monitoring turned on, and the owner or admin role. - A Netlify project that serves your website, and access to its Project configuration. ## Set up Netlify step by step ### 1. Create the deploy hook in Rookflare Open the website, go to the Settings tab and select “Create deploy hook” in the “Scan after deploy” card. Copy the token right away: this is the only time Rookflare shows it in full. The card keeps the endpoint and the last four characters of the token. ### 2. Copy the webhook URL Netlify’s HTTP POST notification has no field for custom headers, so the token goes into the URL as a query parameter. Treat the whole URL as a secret. ```bash https://app.rookflare.example/api/webhooks/deploy?token=YOUR_DEPLOY_TOKEN ``` ### 3. Add the deploy notification in Netlify In Netlify, open Project configuration → Notifications → Deploy notifications and add an “HTTP Post Request” notification. Pick the event “Deploy succeeded” and paste the URL. Netlify also offers a JWS secret token that signs each request in an X-Webhook-Signature header; Rookflare does not check it, so you can leave it empty. ### 4. Trigger a deploy On the project’s Deploys page, trigger a new deploy, or push to the production branch. When Netlify marks the deploy as published, “Last used” on the Rookflare card changes and the website’s Scan history shows a scan with the trigger “After deploy”. Sample endpoint and placeholder token. The dashboard fills in yours. ## If it does not work ### Deploy previews and branch deploys start scans If Netlify also sends the notification for deploy previews and branch deploys, each one starts or joins a scan of your live site, because Rookflare does not read the deploy context. To scan only after production deploys, use the build plugin approach in the questions below instead of the notification. ### Manual deploys start a new scan each time Deploys made by drag and drop or from the Netlify CLI without Git have no commit reference. Rookflare then has no ref to match, so each call starts a scan unless one is already running. ### Calls stopped working after you rotated the token Edit the notification in Deploy notifications and paste the new URL from the Rookflare card. The old token stops working the moment you rotate it. ### Rookflare answers with an error code 401 means a wrong, rotated or revoked token, 402 a plan or daily limit, 409 an unverified or paused website and 429 more than 30 calls a minute. The cURL guide explains each answer and what to do. ## Netlify integration questions ### Can I start scans only for production deploys? Yes, with a small local build plugin instead of the notification. Its onSuccess handler runs when the deploy succeeds and can send the cURL request with the COMMIT_REF environment variable as the ref. Register it under [[context.production.plugins]] in netlify.toml so it runs only in the production context, and keep the token in a Netlify environment variable. ### Which of Netlify’s other deploy events should I use? Only “Deploy succeeded”. “Deploy started” fires before your new version is live, so a scan would see the old one, and failed deploys change nothing on your site. ### We have several Netlify projects from one repository. Each Netlify project has its own notifications. Add the notification only to the project that serves the website you monitor, with that website’s token in the URL. ## Related integrations - [Vercel integration](https://rookflare.com/integrations/vercel/) - [Cloudflare Pages integration](https://rookflare.com/integrations/cloudflare-pages/) - [GitHub Actions integration](https://rookflare.com/integrations/github-actions/) [Start the free trial](https://app.rookflare.com/register/).