Webhook Receiver Documentation

Overview

Your application receives webhook events from our platform exactly as it would from Stripe, Razorpay, GitHub, or any provider — with added reliability.

• Original payload (unchanged)
• Automatic retries with backoff
• Replay of failed events
• Delivery metadata headers
• HMAC signature verification

Request Format

All webhook requests are delivered as HTTP POST requests with a JSON body.

POST /your-webhook-endpoint
Content-Type: application/json

Payload

The request body contains the original event payload sent by the provider. We do not wrap or modify the payload.

{
  "id": "evt_123",
  "type": "payment_intent.succeeded",
  "data": {
    "object": {
      "id": "pi_456",
      "amount": 2000,
      "currency": "usd"
    }
  }
}

Request Headers

Each webhook delivery includes metadata headers for observability and security.

X-Webhook-Source: stripe
X-Webhook-Event-Id: 9bafc1b2-acde
X-Webhook-Delivery-Id: 1021
X-Webhook-Attempt: 2
X-Webhook-Signature: <hmac-sha256>

Signature Verification

Each request is signed using HMAC SHA256. You should verify the signature before processing the payload.

hash_hmac(
  'sha256',
  raw_request_body,
  signing_secret
)

Retries & Replay

Failed deliveries are retried automatically. You can replay events manually from the dashboard at any time.

• Same payload
• Same event ID
• New delivery attempt
• Incremented attempt count

Your webhook handler should be idempotent.

Best Practices

• Always verify the signature
• Return HTTP 200 on success
• Use event ID for idempotency
• Queue long-running jobs
• Log delivery metadata