Webhooks
Receive signed events and operate webhook deliveries safely.
Updated 12/07/2026
On this page
Delivery flow
Create a webhook endpoint for an application, select sandbox event types, and send a controlled test event. Every delivery receives an immutable event ID and delivery record.
Signature verification
Verify the timestamp and signature using the endpoint signing secret before processing a payload. Reject stale timestamps to reduce replay risk and compare signatures using a constant-time operation.
Reliability
Return a successful response promptly after durable receipt.
Process events idempotently using the event ID.
Inspect delivery attempts and safe error summaries in the console.
Retry only eligible failed deliveries.
Rotate signing secrets through the authorized application workflow.
Signing secrets are shown once and are never returned in delivery logs.