Webhooks
Signed, retried notifications so your systems hear about events without polling.
A webhook is how another system finds out something happened without asking repeatedly. The alternative is polling, which is either slow or wasteful and usually both.
How it works
- You register an endpoint against the events you care about.
- Deliveries carry
X-Webhook-EventandX-Webhook-Signature, the signature being an HMAC-SHA256 over the raw body. - Attempts are recorded and failures retried, so a brief outage at your end does not lose the event.
Verify the signature, and use the raw body
An unverified webhook endpoint is a public URL that will do whatever the payload says. Anyone who guesses it can post to it.
The specific trap: compute the HMAC over the raw request body, before any JSON parsing. Parse and re-serialise first and the bytes change — key order, whitespace, unicode escaping — and every signature check fails for reasons that look like a bug in the sender.
What it does not do
It does not guarantee ordering, and it does not promise exactly-once delivery. A retried delivery may arrive twice, so handlers should be idempotent — act on the event id, not on the fact that a request arrived.
Stop reconciling stock by hand
One catalogue, six channels, one stock figure that stays right.