Webhooks: signatures, retries and replay

6 min read

Receive signed, retried event deliveries for leads and tickets.

Webhooks push events to your endpoint the moment they happen. Cadey signs every delivery and retries on failure.

Subscribe

Add an endpoint URL under Settings → Webhooks and select events. Lead and ticket events are available today: lead.created, ticket.created, ticket.resolved, ticket.state_changed, ticket.sla_breached, ticket.csat_received.

Verify the signature

Each request carries an X-Cadey-Signature header of the form t=<timestamp>,v1=<hmac>. Compute HMAC-SHA256 over `${t}.${rawBody}` with your endpoint secret and compare to v1 (constant-time). Reject if the timestamp is too old to stop replay.

const expected = hmacSha256(secret, `${t}.${rawBody}`)
if (!timingSafeEqual(expected, v1)) reject()

Retries

A non-2xx response or a timeout is retried with backoff. Deliveries are idempotent, dedupe on the event id so a retry never double-processes.