Delivery behaviour
Read from the vendor's own documentation, last checked 2026-08-06. Where the vendor states no number, this table carries none.
| Response budget | 2s Counted as request_timeout when the bot server has not answered within 2 seconds |
|---|---|
| Retry | Webhook redelivery, off by default (enable in the channel's Messaging API settings); count and interval undisclosed |
| Gives up | May suspend webhook sending if the bot server keeps failing to receive them; threshold unpublished |
| Source | https://developers.line.biz/en/docs/messaging-api/receiving-messages/ |
Signature
Verified against a working verifier proven by a test suite, not read from documentation. Last verified 2026-08-20.
| Algorithm | HMAC-SHA256 |
|---|---|
| Signed payload | raw body |
| Encoding | base64 |
| Header | x-line-signature = base64 |
| Tolerance | none enforced |
Verify it
The raw request body, byte for byte, before any JSON parsing. Every scheme on this page breaks the moment a framework re-serializes the payload.
const crypto = require("node:crypto");
// base64(HMAC-SHA256(channel secret, raw body))
const expected = crypto
.createHmac("sha256", channelSecret) // Messaging API → Basic settings
.update(rawBody)
.digest("base64");
const received = Buffer.from(req.headers["x-line-signature"] ?? "");
const wanted = Buffer.from(expected);
// timingSafeEqual throws on a length mismatch, so check that first.
const valid =
received.length === wanted.length && crypto.timingSafeEqual(received, wanted);What bites
Redelivery exists but ships disabled — it has to be switched on in the channel's Messaging API settings, and LINE does not disclose the count or the interval. Until you flip it, every failed delivery is a lost message.
LINE may suspend webhook sending entirely if the bot server keeps failing to receive, and the threshold is unpublished. A relay that answers in about a second, and declines only what it cannot store, takes most of that variable off the table.
Read more
AnyHook sits in front of endpoints that receive from LINE: it answers in about a second, retries on its own schedule when your server is down, and keeps every event replayable. Change one URL, keep your code.