Events that prove where they came from
Subscribe to events like order.paid or customer.created. Each delivery is signed, retried on a schedule when your server is down, and listed in a delivery log the merchant can replay from.
Webhook Deliveries · Rider Sync
https://ridersync.example/webhooks
- X-App-Event
- order.paid
- X-App-Signature
- 4be1c09f7d2a…e61f
- X-App-Delivery
- 9f3c2e1a-…-77b0
Attempts
- Attempt 1 / 6 · the app was down 503 · Retrying
- Attempt 2 / 6 · signature verified 200 · Delivered
In short
Webhooks deliver platform events such as order.created, order.paid and customer.created to your app, signed with HMAC SHA256 in the X-App-Signature header. A failed delivery is attempted up to six times over about eleven hours, then dead lettered, and every delivery is kept in a log for 30 days.
The problem it solves
A webhook your server missed while it restarted is an order your app never saw. Without a signature, anyone who guesses the URL can send you fake orders.
How it works
4 steps, start to finish
-
1
Subscribe
Choose the events your app needs, such as order.status.changed or cms.entry.published.
-
2
Verify the signature
Check X-App-Signature against the timestamp and body with your webhook secret.
-
3
Missed one? It retries
Retries run at 1m, 5m, 30m, 2h and 8h before the delivery is dead lettered.
-
4
Replay
The merchant's Webhook Deliveries screen has a Replay button for each delivery.
In detail
What signed webhooks does for you
-
Signed
HMAC SHA256 over the timestamp and body, with the app's own secret.
-
Real events
Orders, customers, published content, media and the app's own lifecycle.
-
Six attempts
Spaced out over hours before a delivery is dead lettered.
-
Delivery log
Delivered, Retrying and Dead-lettered, kept for 30 days.
-
Replay
Replay from the merchant's screen, the CLI or GraphQL.
-
Always told
app.uninstalled and profile.data.erased are delivered to every app.
-
Verify the X-App-Signature header: an HMAC SHA256 of the timestamp and the body, keyed with your app's webhook secret.
-
The delivery is retried after 1 minute, 5 minutes, 30 minutes, 2 hours and 8 hours. After the sixth attempt it is dead lettered.
-
Yes. The merchant can Replay it from Webhook Deliveries, and developers can replay from the CLI or GraphQL.
-
Among others: order.created, order.paid, order.status.changed, customer.created, cms.entry.published and media.uploaded. Events that need a scope, such as customer or content events, reach only apps holding it.
Works together with
Signed webhooks · Free to start
Try signed webhooks on your own business
Set up in a couple of minutes. Your catalogue, orders and books stay yours to export.
- Live in 2 minutes
- Free to start
- No credit card
