Webhook delivery infrastructure
A REST API for delivering webhooks the way they should have shipped the first time.
HMAC signing, idempotency keys, exponential-backoff retries, circuit breakers, dead-letter handling, per-attempt observability. The thirty features your team would otherwise build over six months, behind one endpoint.
Ingest an event
curl -X POST https://api.webhook-relay.dcsuniverse.com/v1/events \
-H "Authorization: Bearer whk_live_..." \
-H "Idempotency-Key: order-42-created" \
-d '{
"type": "order.created",
"payload": {"order_id": 42}
}'Verify on the receiver
import { verifySignature } from "@philiprehberger/webhook-relay-client";
const ok = verifySignature(
process.env.WEBHOOK_SECRET,
rawBody,
request.headers["x-webhook-signature"],
);
if (!ok) return new Response("Bad signature", { status: 400 });What you get out of the box
HMAC signing
Stripe-style t=…,v1=… header. Signature verifier ships in every SDK.
Idempotency keys
24-hour dedup window per workspace. Safe to retry from your side.
Exponential backoff
30s, 2m, 10m, 1h, 6h. Five retries after the first attempt, then dead-letter.
Circuit breaker
Eight consecutive failures auto-pauses a subscription. Notifications, no surprises.
Dead-letter queue
Replay individual failures with one POST. Operator-facing list filters by sub and since.
Per-attempt observability
Status, latency, signature header, response snippet — every attempt, every event.
SSRF protections
Private + loopback IPs blocked at the egress. One less production incident.
Workspace rate limits
Per-workspace token bucket, X-RateLimit-* headers on every response.
Signing key rotation
Rotate with a 48-hour grace window. Receivers update at their own pace.
See it work, live.
Paste a sandbox key from the reference page and watch deliveries stream in real time via Server-Sent Events.
Live Echo
Watch deliveries land in real time
Paste a key, connect, then fire events from the reference and watch each delivery stream in here.
Paste a key and connect to begin.
SDKs in four languages
Generated from the OpenAPI spec, hand-tuned signature verifiers, one install per language.