Check the URL, the 2xx response and that you verify the signature over the raw body.
- The URL must be public https; redirects are not followed.
- Reply 2xx within 10 seconds.
- Compute HMAC-SHA256 of
t + "." + bodywith that endpoint’s secret, without re-serialising the JSON. - Check the mode: a test endpoint receives no live events.
- Check the delivery log and tap “Resend”.
Related guide: Signed webhooks: know everything instantly. Adding an endpoint, choosing events, verifying the signature in Node.js, Python and PHP, retries, idempotency and the full event list.
Related articles
Was this helpful?
Thanks. We will use it to improve.