Delivery behaviour
Read from the vendor's own documentation, last checked 2026-08-06. Where the vendor states no number, this table carries none.
| Response budget | 10s |
|---|---|
| Retry | None. GitHub does not automatically redeliver failed deliveries |
| Gives up | No disable. Deliveries stay redeliverable by hand for 3 days, then the record is gone |
| Source | https://docs.github.com/en/webhooks/using-webhooks/best-practices-for-using-webhooks |
Signature
Verified against a working verifier proven by a test suite, not read from documentation. Last verified 2026-08-20.
| Algorithm | HMAC-SHA256 |
|---|---|
| Signed payload | raw body |
| Encoding | hex |
| Header | x-hub-signature-256 = sha256=hex |
| Tolerance | none enforced |
Verify it
The raw request body, byte for byte, before any JSON parsing. Every scheme on this page breaks the moment a framework re-serializes the payload.
const crypto = require("node:crypto");
// x-hub-signature-256: "sha256=" + hex(HMAC-SHA256(secret, raw body))
const expected =
"sha256=" +
crypto.createHmac("sha256", webhookSecret).update(rawBody).digest("hex");
const received = Buffer.from(req.headers["x-hub-signature-256"] ?? "");
const wanted = Buffer.from(expected);
// timingSafeEqual throws on a length mismatch, so check that first.
const valid =
received.length === wanted.length && crypto.timingSafeEqual(received, wanted);What bites
One attempt is all you get. Every other sender on this list retries on its own; GitHub does not, so a 30-second deploy window drops events with no second chance. The redeliver button (and the Redelivery API) work per delivery, by hand, for 3 days — after that the record itself is gone.
Read more
AnyHook sits in front of endpoints that receive from GitHub: it answers in about a second, retries on its own schedule when your server is down, and keeps every event replayable. Change one URL, keep your code.