Production notes on delivery, retries, signature verification, debugging, and replay, from the team building AnyHook.
All posts
GitHub does not retry failed webhook deliveries. Not once. The delivery record lasts three days, and then a bad deploy has cost you events permanently.
HubSpot does not guarantee ordering and documents its eventId as not guaranteed to be unique. Every instinct you built on Stripe's event.id fails here.
Miss access.granted and a user files a ticket. Miss access.revoked and nobody notices: from the outside everything still works. Uptime is an access control.
Merchant of record billing has a tighter response budget and a denser retry curve. What changes when an indie SaaS moves to Paddle or Lemon Squeezy.
Slack wants a 2xx within three seconds and disables your subscriptions if 95% of deliveries fail in an hour. The only webhook failure your users watch happen.
Twilio is the only major sender that lets you configure connect timeout, read timeout, total time, and retry count. Five dials nobody turns.
No Node crypto, a CPU budget in milliseconds, and waitUntil that is not durable. What changes when the receiver is a Worker, from AnyHook's own ingress.
WooCommerce queues webhooks through Action Scheduler, which runs on WP-Cron, which runs when somebody visits your site. Five failures and it is disabled.
Every major provider delivers at-least-once: duplicates are guaranteed, not exceptional. Four idempotency patterns ranked by how much they protect you.
Nine times out of ten it's the test URL, which only listens while you're watching. The rest: response mode, a consumed raw body, or a lost event.
Shopify gives your endpoint five seconds, retries eight times over four hours, then removes the subscription. Nothing throws. Orders just stop arriving.
Stripe disabled your webhook endpoint, and the 30-day recovery window is smaller than it sounds. The exact sequence: re-enable, backfill from the Events API.
Signature checks that fail for no reason, waitUntil work that vanishes, cold starts that eat the timeout budget: what bites on serverless and what to do.
Polling wastes requests but degrades gracefully. Webhooks are efficient but fail silently. Plus the hybrid almost every serious integration ends up building.
Half the internet still answers by email: codes, receipts, notifications. One keyless call gives an agent a real inbox it reads back as webhook events.
A catch-all address, a Worker email handler, and about sixty lines: every email to your domain becomes a JSON POST to your existing HTTP pipeline.
A webhook log in a mutable database is a claim, not evidence. How AnyHook's event log became verifiable: per-app hash chains, daily seals, public anchors.
If your test builds the signature with the formula your verifier checks, both can be wrong and stay green. Cross-check against the provider's SDK.
Agents can call APIs; receiving events is the missing half. What breaks when an agent needs a webhook endpoint, and what an agent-operable service looks like.
Stripe 大概給你 20 秒，OpenAI tool call 跑 45 秒。這個時間錯位是雙重扣款最常見的來源。為什麼會壞，以及 edge ack + async deliver 的做法。
Debugging webhook delivery: what to look for in headers, status codes, timing, and payloads when your integration stops working.
Why naive exponential backoff causes thundering herds, how jitter fixes it, and what production-grade retry schedules actually look like.
Your server went down for an hour. Stripe, GitHub, and Shopify kept sending webhooks. How to replay the events you missed, with and without a relay.
ngrok is great for local dev. It's not a production strategy. Here is what you need past the tunnel, for staging, production, and the gray area in between.
Stripe retries failed webhooks for up to 3 days. Here is how the schedule works, what breaks when your endpoint is down, and how to design for it.
Verifying webhook signatures across providers: what goes wrong, how timestamp tolerance works, and why retries break naive implementations.
Change one URL, get automatic retries, full event log, and one-click replay. Free plan, no credit card.