Delivery behaviour
Read from the vendor's own documentation, last checked 2026-08-06. Where the vendor states no number, this table carries none.
| Response budget | not published by the vendor |
|---|---|
| Retry | not published by the vendor |
| Gives up | not published by the vendor |
Signature
Verified against a working verifier proven by a test suite, not read from documentation. Last verified 2026-08-20.
| Algorithm | HMAC-SHA256 |
|---|---|
| Signed payload | raw body, no timestamp |
| Encoding | hex |
| Header | sentry-hook-signature |
| Tolerance | none enforced |
Verify it
The raw request body, byte for byte, before any JSON parsing. Every scheme on this page breaks the moment a framework re-serializes the payload.
const crypto = require("node:crypto");
// hex(HMAC-SHA256(client secret, raw body)) — no timestamp anywhere
const expected = crypto
.createHmac("sha256", clientSecret) // Settings → Developer Settings
.update(rawBody)
.digest("hex");
const valid = crypto.timingSafeEqual(
Buffer.from(req.headers["sentry-hook-signature"]),
Buffer.from(expected),
);What bites
Nothing in the signed payload expires: no timestamp means a captured request verifies as cleanly a month later as it did live. Idempotency on your side is the only thing standing between a replayed capture and a re-run side effect.
Read more
AnyHook sits in front of endpoints that receive from Sentry: it answers inside the budget above, retries on its own schedule when your server is down, and keeps every event replayable. Change one URL, keep your code.