Blog
Field notes on signature verification, idempotency, delivery guarantees, and running webhook infrastructure in the EU. The code that came out of it is in our free open-source tools.
Which Stripe webhook event should trigger fulfilment: checkout.session.completed or payment_intent.succeeded? What each event carries, why SEPA Direct Debit and other delayed methods break naive handlers, what happens with subscriptions and free orders, and a handler that fulfils exactly once.
How Git webhooks work on GitHub, GitLab, Bitbucket Cloud and Gitea or Forgejo: the event and delivery headers each one sends, how each signs requests (HMAC, plain token or signing token), timeouts, retries and auto-disabling, and one receiver that verifies all four. Plus how Git webhooks differ from Git hooks.
What a webhook payload actually contains: the event envelope, JSON vs form-encoded bodies, the headers that carry the event type, delivery ID and signature, and real payloads from GitHub, Stripe, Shopify and Slack side by side. Plus the parsing mistakes that break handlers and how to design a payload if you send webhooks.
A layered way to test webhooks: catch a real request to see what the provider sends, unit-test the handler against raw bytes, send signed events to localhost, rehearse retries and duplicates, gate merges in CI, and check that webhooks still work in production.
How Discord webhooks work in both directions. Creating a webhook URL, sending messages, embeds, files and thread posts to it, editing what you sent, the GitHub-compatible endpoint, 429s and error codes, and receiving Discord's own webhook events with Ed25519 signatures.
How Shopify webhooks behave in production. The three ways to subscribe (admin, shopify.app.toml and the GraphQL Admin API), the delivery headers, the topics worth handling, filters and include_fields, the 5-second timeout, eight retries in four hours, duplicates, ordering and local testing.
Webhooks deliver events as POST requests. Where GET and HEAD still show up (Meta, Dropbox, Trello, Twilio, HubSpot, Discord), why a POST webhook can arrive as a GET after a redirect, and how to handle both methods on one endpoint.
How Slack webhooks work in both directions. Creating an incoming webhook URL and posting messages to it, the 1-per-second limit and its errors, receiving events through the Events API, the url_verification challenge, the 3-second timeout, retries, and verifying the v0 request signature.
A webhook URL is the HTTPS address a provider sends event notifications to. How to create one, where to paste it in Stripe, GitHub and Shopify, where to find a Slack or Discord webhook URL, and what the URL has to answer.
No webhook relay is "GDPR certified". The relay is your processor under Article 28, and compliance comes down to features you can check: processing region, sub-processors, DPA, retention, deletion, encryption and access control. A twelve-point checklist, plus six relays and gateways checked against it on 21 September 2026.
Hook0 and Hookdeck compared on webhook direction, hosting region, licence and self-hosting, retries, billing unit, free tier, DPA and sub-processors, with every fact linked to the vendor's own pages and checked on 21 September 2026.
How HubSpot webhooks behave in production. The Webhooks API for apps compared with the workflow "Send a webhook" action, batched payloads, the five-second timeout, retry windows, and X-HubSpot-Signature-v3 verification in Node and Python.
How GitHub webhooks behave in production. Repository, organization and GitHub App webhooks, the delivery headers, the events worth subscribing to, the 10-second timeout, why failed deliveries are never retried, the three-day redelivery window, and how to test locally.
Retries and replay cover different failures on the receiving side. What Stripe, GitHub, Shopify, Resend, HubSpot and Twilio actually retry, which status codes to return, why retries alone lose events, and a runbook for an endpoint that was down for eight hours.
A webhook is a single HTTP POST a provider sends to your server when something happens. A WebSocket is a connection your client opens and keeps open. Here is what each looks like on the wire, what each guarantees when something fails, and where Server-Sent Events and polling fit.
A webhook is an HTTP request one application sends to another when something happens. What that looks like on the wire, what a webhook URL is, where webhooks beat polling and where they are the wrong tool.
Webhooker and Hookdeck Event Gateway compared on hosting region, verification, retries, billing unit, retention, seats, SLA and DPA, with every Hookdeck fact linked to Hookdeck's own pages and checked on 14 September 2026.
ngrok alternatives for receiving webhooks on localhost, compared on free limits, stable URLs and what happens to events while your laptop is offline. Cloudflare Tunnel, Tailscale Funnel, localtunnel, Hookdeck CLI, smee.io, Webhook Relay and more, checked 14 September 2026.
Svix alternatives sorted by job. Hookdeck Outpost, Convoy, Hook0, HookGet, wehook.io and Hook Mesh send webhooks; Webhooker, Hookdeck Event Gateway, Convoy and EventDock receive them. Pricing, hosting, DPA and licenses checked 14 September 2026.
Webhook.site and RequestBin alternatives sorted by job: quick inspection without signup, mocked responses, forwarding to localhost, self-hosted testers, and what to use once test traffic turns into production. Limits and prices checked 14 September 2026.
How Stripe webhooks behave in production. Which events to handle for Checkout and subscriptions, the three-day retry window, duplicates and ordering, testing with stripe listen, and recovering events after an outage.
How to receive, verify and replay Sweego webhooks in local and staging environments. Signature check in Node, event catalogue, and a workflow that does not burn SMS credits.
Hookdeck alternatives for EU teams, sorted by what they do. Webhooker, Svix Ingest and Convoy receive webhooks; HookGet, wehook.io, Ploq and Hook0 send them. Hosting, DPA and prices checked 14 September 2026.
Per-event, per-seat, per-destination or self-hosted — each model breaks at a different point. Here's how to compare them, and why overage billing turns a traffic spike into an invoice.
Most webhook payloads carry an email, a name or an IP, which makes them personal data under GDPR. Here's what that means for your webhook layer: roles, retention, deletion and sub-processors.
Some destinations only accept traffic from known IPs. Here's why cloud egress addresses drift, what a static outbound IP gives you, and why an allowlist is not a substitute for signatures.
How to run webhook delivery on a Postgres table with SELECT ... FOR UPDATE SKIP LOCKED — the claim query, lock timeouts longer than the HTTP call, a slow destination that must not starve the rest, and when to move to a broker.
Webhooks arrive out of order by default. When ordering actually matters, how FIFO delivery works, and what head-of-line blocking costs you.
Where a webhook acknowledgement gets lost, why that rules out exactly-once over HTTP, and four questions to ask a vendor that claims it anyway.
Most explanations stop at "the provider sends you a POST". Here is the real request, header by header, what your 200 actually means, and what the sender does when you do not answer.
How to get, find or create your Stripe webhook signing secret. It lives in the Webhooks tab in Workbench behind "Click to reveal"; the CLI prints its own, the API returns one at creation, and test and live never share a secret.
Six causes behind "No signatures found matching the expected signature for payload" and its equivalents: a parsed body, the wrong secret, hex vs base64, clock skew, a rewriting proxy, or test vs live keys.
An API gives you data when you ask. A webhook sends it when something happens. The decision that matters is which side of the connection has to be reliable.
A signature proves a webhook was genuine once. Without a timestamp check, a captured request stays valid forever. Here's how tolerance windows, clock skew and dedupe stop replays.
A public webhook endpoint accepts POSTs from anyone. This is the full security model: verify the provider's HMAC signature, reject replays with a timestamp window, and sign what you forward.
Shopify's HMAC is base64, not hex, which trips up most integrations. Verify it correctly and handle the mandatory GDPR webhooks reliably.
Svix, Hookdeck and Webhooker compared on direction, hosting region, retention, billing unit and DPA, with every competitor fact linked to the vendor's own page.
When retries run out, a webhook shouldn't just vanish. A dead letter queue catches failed deliveries so you can inspect and replay them.
At-least-once delivery means your consumer sometimes sees the same event twice. How to dedupe with a stable event id, and how that differs from the Idempotency-Key header you send when calling an API.
GitHub signs webhooks with X-Hub-Signature-256. Verify the HMAC against the raw body and handle redeliveries so you never process an event twice.
Rolling your own webhook receiver looks simple until verification, retries, idempotency and replay pile up. A build-vs-buy cost breakdown with the hours counted.
Naive retries hammer a destination that's already down. Retry webhooks properly instead: exponential backoff, jitter and a circuit breaker.
Stripe signs webhooks with the Stripe-Signature header. How the signed payload is built, how to recompute the HMAC-SHA256 over the raw bytes, and how the timestamp tolerance stops replays.
Webhooks routinely carry personal and payment data, and the gateway sees all of it. Here's why EU-only ingest, storage and delivery matter under GDPR.
A webhook gateway sits between the apps that send you webhooks and your code — it verifies, stores, retries and replays every event, so a plain webhook receiver in your app never has to.
No articles match your search.
Webhooker
