Webhook events

Signature scheme — Stripe pattern

Every delivery carries an X-JE-Signature header of the form t=<unix>,v1=<hex>. v1 is HMAC-SHA256(secret, t + "." + raw_body). Reject any delivery where now − t > 300 seconds (5-minute replay window). Use a constant-time comparison for the hash — never ===.

Try-it: paste your secret, body, and signature into the signature verifier — all client-side, your secret never leaves the browser.

Delivery + retry rules

• 2xx = acknowledged. We won't retry.
• 4xx = permanent failure (your endpoint says "don't try again"). We won't retry.
• 5xx or timeout = transient. We retry 3 times with exponential backoff: 1 min, 5 min, 25 min.
• After the final retry, the delivery is recorded as failed in your audit log. No further attempts.