Webhook Engineering
Producing and consuming webhooks you can trust: signatures, replay protection, retries, dead-letter queues and production debugging.
Requires: API Integrations Masterclass
Chapters
- 01
Consumers, producers and trust
Who owns what in a webhook relationship, and why the receiver must never trust the request.
10 min
- 02
Sign payloads with HMAC
Compute HMAC-SHA256 signatures with WebCrypto and understand exactly what is being signed.
12 min
- 03
Verify, timestamp and replay windows
Constant-time comparison, tolerance windows and deduplication by event id.
11 min
- 04
Retries, DLQs and backoff
Exponential backoff with jitter, retry budgets and what to do when an endpoint stays down.
13 min
- 05
Debugging webhooks in production
Delivery logs, replay tooling and the questions to ask when events go missing.
9 min