Receive signed events with delivery history.
Webhooks deliver selected team events to an HTTPS endpoint. Each delivery is signed and retains status and attempt history so an integration can verify authenticity and diagnose failures.
Choose a name, destination URL, and event types. ServerChirp generates the signing secret and shows its plaintext once, immediately after the endpoint is created. Copy it into your secret manager before dismissing it.
For normal HTTPS endpoints, ServerChirp sends these headers:
X-ServerChirp-Signature-256 contains sha256= followed by the hexadecimal HMAC-SHA256 of the raw request body.X-ServerChirp-Event contains the event type.X-ServerChirp-Delivery-Id contains the delivery ID.Compute the expected HMAC from the raw body with the endpoint secret, then compare signatures with a constant-time operation. Use the delivery ID for idempotency.
import { createHmac, timingSafeEqual } from 'node:crypto';
const expected = `sha256=${createHmac('sha256', process.env.SERVERCHIRP_WEBHOOK_SECRET!)
.update(rawBody, 'utf8')
.digest('hex')}`;
const valid =
expected.length === signature.length &&
timingSafeEqual(Buffer.from(expected), Buffer.from(signature));Return a 2xx response quickly after the event has been durably accepted. Perform slow work asynchronously. A delivery times out after ten seconds. HTTP 429, 5xx responses, and transport failures are retryable; other non-2xx responses are recorded as failures without an automatic retry.
Consumers must be idempotent. A delivery can arrive more than once even when the first request reached your server successfully.
Expand an endpoint in the dashboard to inspect recent delivery IDs, event types, attempt counts, response status, and completion time. Use Send test to verify the current endpoint configuration with a sample deployment.succeeded event.
Webhook secrets are not readable or rotatable after creation. To replace one, create a new endpoint, deploy its new secret to the receiver, test it, and then delete the old endpoint.