{
  "name": "Webhook Provider Behaviour Reference",
  "url": "https://anyhook.net/providers",
  "license": "CC-BY-4.0",
  "attribution": "AnyHook, https://anyhook.net/providers",
  "verified": {
    "delivery": "2026-08-06",
    "signature": "2026-04-15"
  },
  "notes": {
    "signature": "Verified against a working verifier per provider, proven by a test suite, not read from documentation alone.",
    "delivery": "Read from each vendor's own documentation. null means the vendor publishes no figure or we have not verified one."
  },
  "providers": [
    {
      "name": "Slack",
      "responseBudget": "3s",
      "retry": "3 retries: immediately, after 1 min, after 5 min",
      "disable": "Event subscriptions disabled if over 95% of attempts fail within 60 min",
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "v0:{timestamp}:{body}",
        "encoding": "hex",
        "header": "x-slack-signature = v0=hex",
        "tolerance": "5 min"
      },
      "source": "https://docs.slack.dev/apis/events-api/"
    },
    {
      "name": "Discord",
      "responseBudget": "3s",
      "budgetNote": "Interaction endpoints must send an initial response within 3 seconds",
      "retry": null,
      "disable": null,
      "signature": {
        "algorithm": "Ed25519",
        "signedPayload": "{timestamp}{body}",
        "encoding": "hex",
        "header": "x-signature-ed25519 + x-signature-timestamp",
        "tolerance": null
      },
      "source": "https://docs.discord.com/developers/interactions/receiving-and-responding"
    },
    {
      "name": "Shopify",
      "responseBudget": "5s",
      "retry": "8 attempts over 4 hours",
      "disable": "Subscription deleted after repeated failures within a 24-hour period",
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "raw body",
        "encoding": "base64",
        "header": "x-shopify-hmac-sha256",
        "tolerance": null
      },
      "source": "https://shopify.dev/docs/apps/build/webhooks/troubleshooting-webhooks"
    },
    {
      "name": "Paddle",
      "responseBudget": "5s",
      "retry": "Live: 60 attempts over 3 days, 20 in the first hour, 47 in the first day. Sandbox: 3 attempts over 15 min",
      "disable": null,
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "{timestamp}:{body}",
        "encoding": "hex",
        "header": "paddle-signature = ts=X;h1=hex",
        "tolerance": "5s"
      },
      "source": "https://developer.paddle.com/webhooks/about/respond-to-webhooks"
    },
    {
      "name": "HubSpot",
      "responseBudget": "5s",
      "budgetNote": "Applies to the whole batch, which can carry up to 100 notifications",
      "retry": "Up to 10 attempts spread over 24 hours",
      "disable": null,
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "POST{decodedUrl}{body}{timestamp}",
        "encoding": "base64",
        "header": "x-hubspot-signature-v3",
        "tolerance": "5 min"
      },
      "source": "https://developers.hubspot.com/docs/api-reference/latest/webhooks/guide"
    },
    {
      "name": "GitHub",
      "responseBudget": "10s",
      "retry": "None. GitHub does not automatically redeliver failed deliveries",
      "disable": "No disable. Deliveries stay redeliverable by hand for 3 days, then the record is gone",
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "raw body",
        "encoding": "hex",
        "header": "x-hub-signature-256 = sha256=hex",
        "tolerance": null
      },
      "source": "https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks"
    },
    {
      "name": "Twilio",
      "responseBudget": "15s",
      "budgetNote": "Configurable. rt read timeout default 15000ms (max 15000), ct connect default 5000ms (max 10000), tt total default 15000ms",
      "retry": "Configurable: rc 0 to 5, default 1. rp selects which failures qualify",
      "disable": null,
      "signature": {
        "algorithm": "HMAC-SHA1",
        "signedPayload": "full URL + form params sorted by key",
        "encoding": "base64",
        "header": "x-twilio-signature",
        "tolerance": null
      },
      "source": "https://www.twilio.com/docs/usage/webhooks/webhooks-connection-overrides"
    },
    {
      "name": "Stripe",
      "responseBudget": null,
      "budgetNote": "Stripe publishes no figure. Its docs say only to return 2xx before any slow logic. 20s is the community working number",
      "retry": "Exponential backoff for up to 3 days in live mode. Sandbox: 3 attempts over a few hours",
      "disable": "Endpoint disabled after continued failure, with an email first. Events stay in the Events API for 30 days",
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "{timestamp}.{body}",
        "encoding": "hex",
        "header": "stripe-signature = t=X,v1=hex",
        "tolerance": "5 min"
      },
      "source": "https://docs.stripe.com/webhooks"
    },
    {
      "name": "Svix (Clerk, Resend)",
      "responseBudget": null,
      "retry": "8 attempts: immediately, 5s, 5 min, 30 min, 2h, 5h, 10h, 10h. Then a message.attempt.exhausted operational webhook",
      "disable": "Endpoint disabled after all attempts fail for 5 days",
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "{id}.{timestamp}.{body}",
        "encoding": "base64",
        "header": "svix-signature = v1,base64",
        "tolerance": null
      },
      "source": "https://docs.svix.com/retries"
    },
    {
      "name": "WooCommerce",
      "responseBudget": null,
      "budgetNote": "Delivery is queued into Action Scheduler and driven by WP-Cron, so it leaves when a page is next loaded rather than when the event happens",
      "retry": null,
      "disable": "Webhook disabled after more than five consecutive delivery failures",
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "raw body",
        "encoding": "base64",
        "header": "x-wc-webhook-signature",
        "tolerance": null
      },
      "source": "https://woocommerce.com/document/webhooks/"
    },
    {
      "name": "Lemon Squeezy",
      "responseBudget": null,
      "retry": null,
      "disable": null,
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "raw body",
        "encoding": "hex",
        "header": "x-signature + x-event-name",
        "tolerance": null
      }
    },
    {
      "name": "PayPal",
      "responseBudget": null,
      "retry": null,
      "disable": null,
      "signature": {
        "algorithm": "RSA-SHA256",
        "signedPayload": "{txId}|{txTime}|{webhookId}|{crc32(body)}",
        "encoding": "base64",
        "header": "paypal-transmission-sig + 4 more",
        "tolerance": null
      }
    },
    {
      "name": "SendGrid",
      "responseBudget": null,
      "retry": null,
      "disable": null,
      "signature": {
        "algorithm": "ECDSA P-256",
        "signedPayload": "{timestamp}{body}",
        "encoding": "base64",
        "header": "x-twilio-email-event-webhook-signature",
        "tolerance": null
      }
    },
    {
      "name": "Linear",
      "responseBudget": null,
      "retry": null,
      "disable": null,
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "raw body",
        "encoding": "hex",
        "header": "linear-signature",
        "tolerance": null
      }
    },
    {
      "name": "Sentry",
      "responseBudget": null,
      "retry": null,
      "disable": null,
      "signature": {
        "algorithm": "HMAC-SHA256",
        "signedPayload": "raw body, no timestamp",
        "encoding": "hex",
        "header": "sentry-hook-signature",
        "tolerance": null
      }
    },
    {
      "name": "Intercom",
      "responseBudget": null,
      "retry": null,
      "disable": null,
      "signature": {
        "algorithm": "HMAC-SHA1",
        "signedPayload": "raw body",
        "encoding": "hex",
        "header": "x-hub-signature = sha1=hex",
        "tolerance": null
      }
    },
    {
      "name": "Vercel",
      "responseBudget": null,
      "retry": null,
      "disable": null,
      "signature": {
        "algorithm": "HMAC-SHA1",
        "signedPayload": "raw body",
        "encoding": "hex",
        "header": "x-vercel-signature",
        "tolerance": null
      }
    }
  ]
}