Webhooks that power real‑time SaaS

Webhooks let one system call your URL the moment something happens. They are simple HTTP requests that carry an event, such as an order created or a user updated. Here is how I design subscribe, retry and signature patterns that hold up in production.

Subscribe pattern

• Offer a subscribe endpoint that accepts the destination URL, chosen event types and a contact email. Generate a shared secret for signing.
• Verify ownership before sending live data. Send a one time token and require the receiver to echo it back or respond with a correct signature.
• Store the endpoint, secret, event types, schema version and the account that owns the subscription.
• On subscribe, send a test event the receiver can acknowledge. Allow a resend on demand for troubleshooting.
• Include an event id and schema version in every delivery so receivers can dedupe and map changes safely.

Retry pattern

• Treat only 2xx as success. Retry everything else, including timeouts and connection errors.
• Use exponential backoff with a small random spread to avoid traffic spikes. Cap the total number of attempts.
• Stop retrying on clear permanent signals such as 410 or an unsubscribe.
• Make the receiver idempotent. Idempotent means the same event can be processed more than once without double effects. Use the event id as the idempotency key.
• Return quickly from the receiver. Queue the work and respond 200 or 202 fast so retries are not triggered by slow processing.

Signature verification

• Sign each request with HMAC SHA 256 using the shared secret. HMAC is a way to sign data so the receiver can confirm it came from you.
• Include a timestamp in the signature and reject old messages to reduce replay risk.
• Compare signatures using a constant time method and fail closed on any mismatch.
• Require HTTPS and rotate secrets. Support two active secrets during rotation so traffic continues.

What to check

• Simulate duplicates, out of order deliveries and late arrivals. Confirm the receiver processes each event once.
• Force timeouts to watch backoff and the cap on attempts. Confirm permanent errors stop retries.
• Rotate the secret and prove old signatures fail while new ones pass.
• Unsubscribe and confirm deliveries cease. Resubscribe and confirm the test event and live traffic work.
• Log event id, subscription id, attempt number, status and processing time. Review logs after each test.

If you want help, I build and maintain webhook systems as part of Custom Development SaaS, Applications, Business Systems & Portals and Engineering Retainers. I also take on Standard Dev Hours and Features & Add-ons for focused improvements.