Webhook delivery and signing
Configure authenticated acceptance, delivery retries, and signing-key rotation.
Use the event delivery reference as the authoritative contract. Delivery acceptance and agent outcome are separate: verify the request, durably store the job, then acknowledge. Slow execution happens afterward. The reference receiver demonstrates this order.
Delivery and recovery
- Request headers and delivery identity
- Response timeout and accepted statuses
- Retryable failures, duplicate delivery, and preserved destinations
- Intentional replay and stored-event inspection
- Reproduce a receiver failure
Signing configuration
Signing must be configured and activated for the endpoint. V2 binds the exact timestamp and raw body; verify before parsing JSON. Do not substitute email sender authentication for webhook authentication or permission to execute an action.
- Verify timestamp-bound signatures
- Prepare, install, and activate a secret
- Migrate existing signed receivers
The reference receiver supports one secret. Production rotation requires overlapping verification keys before activation; generating a candidate alone does not change the active key.