diff --git a/_webhook/deploy.php b/_webhook/deploy.php
new file mode 100644
index 0000000..1c813b7
--- /dev/null
+++ b/_webhook/deploy.php
@@ -0,0 +1,16 @@
+<?php
+header('Content-Type: application/json');
+
+$secret = 'payfrit-deploy-2026';
+$headerSecret = $_SERVER['HTTP_X_FORGEJO_SIGNATURE'] ?? $_GET['secret'] ?? '';
+
+if ($headerSecret !== $secret) {
+    http_response_code(403);
+    echo json_encode(['OK' => false, 'ERROR' => 'unauthorized']);
+    exit;
+}
+
+$triggerFile = '/tmp/deploy-payfrit-api.trigger';
+file_put_contents($triggerFile, date('Y-m-d H:i:s'));
+
+echo json_encode(['OK' => true, 'MESSAGE' => 'Deploy triggered', 'TIME' => date('c')]);