BUILD
Webhooks
Receive signed events reliably and protect against replay.
Last updated July 18, 2026 · 6 min read#Delivery model
Webhook deliveries contain an event identifier, event type, tenant context, occurrence time and resource payload. Endpoints should acknowledge quickly and process asynchronously.
#Verify signatures
text
signed_payload = timestamp + "." + raw_request_body
expected = HMAC_SHA256(webhook_secret, signed_payload)- Verify against the raw body before parsing JSON
- Use constant-time comparison
- Reject timestamps outside the configured replay window
- Deduplicate by event ID before applying side effects
#Retries and failures
Return a 2xx response after durable receipt. Non-2xx responses are retried with exponential backoff; exhausted deliveries are retained for operator review and replay.
Was this page helpful?