For anyone whose platform sends webhooks
Hook ContractCheck your webhooks from the sender's side - then write the contract.
Paste your event names, one real delivery and your retry schedule. Your browser lints the names (resource.action, past tense, one delimiter), reads the envelope and the signing scheme against Standard Webhooks, verifies the delivery's signature with a test secret that never leaves this page, works out what your retry schedule really does, and checks dead-lettering, ordering, auto-disable and the debugging surface. Then the event catalog, and the delivery contract your subscribers can rely on.
The platform free
One real delivery free
Delivery today free
The checks free
What the page flags
Event names
The retry schedule, worked out
Area by area
Verification snippets for your docs free
Standard Webhooks verification - raw body, the 5-minute window, every signature in the header, a constant-time compare.
Node (Express)
Python (Flask)
Go (net/http)
The event catalog metered
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
Caveats
Caveats
The page's check of this reply
Saved platforms
How it works - and what is sourced
The checks are the skill's failure modes: names that are not resource.action in the past tense, or mix delimiters; no single string naming the event; no stable per-event ID; a body-only signature with no signed timestamp, so a captured request replays forever; one active signing secret; no automatic retries, linear retries, or a span shorter than an outage; non-retriable 4xx retried until the budget runs out; ordering left unstated; no dead-letter queue, or one kept outside 7 to 30 days; no auto-disable; and no delivery log, replay or test events.
Signatures follow Standard Webhooks: HMAC-SHA256 over id.timestamp.raw_body with the base64 secret after whsec_, sent as v1,<base64>. The verifier runs with your browser's WebCrypto; the test secret is never part of a run or a saved record. The build-versus-buy rung follows the skill: managed infrastructure by default, a self-hosted gateway when event data may not pass through a third party, in-house when delivery is the product.