Webhooks

Receiver flow

Register an HTTPS receiver and subscribed events on the application's Webhooks page. Securely store the original signing_secret shown once. Subscription names configure filtering; actual event availability depends on business producers, not an illustrative event catalog.

The sender POSTs raw JSON. X-Webhook-Signature is 64 lowercase hex characters and X-Webhook-Event is unsigned. Capture raw bytes → verify with the official SDK → parse JSON and validate business data → return success.

The current signature has no timestamp or delivery ID. Verification does not prevent replay or authenticate the event header. Deduplicate using trusted identifiers from your own business contract, not a fictional delivery header.

Lifecycle

The console currently supports registration, secret rotation and deletion. It has no delivery-history, manual-redelivery, send-test-event or paused-queue controls. Do not assume an automatic retry schedule; evaluate failure handling against the actual business sender contract and make receiving logic tolerant of duplicates.

Rotation immediately replaces the sender secret. Receivers may temporarily configure multiple original secrets for in-flight requests, without a server dual-signing guarantee. Plan receiver configuration changes before rotation/deletion.

See executable signature verification, Webhook management, and small-file uploads.