Guides
Practical webhook guides
Step-by-step engineering guides for the webhook problems that page you: failed deliveries, misbehaving retries, duplicate side effects, signature mismatches, and handlers that are hard to test.
Architecture Build vs Buy: Should You Build a Webhook Retry System? A balanced decision guide for building a webhook ingestion and retry system in-house versus adopting a managed product — what looks simple, what accumulates, and when each choice is right. 11 min read Debugging How to Debug Failed Webhooks: A Step-by-Step Guide A systematic walkthrough for diagnosing failed webhook deliveries: connectivity, status codes, timeouts, signatures, handler exceptions, and a production debugging checklist. 9 min read Reliability How to Replay Failed Webhooks Safely Replaying a failed webhook re-runs a real event with real side effects. A practical guide to doing it safely: replay vs retry, duplicate effects, checking current state, headers and signatures, authorisation, and a pre-replay checklist. 8 min read Testing How to Test Webhooks Locally External providers cannot reach localhost. How to test webhooks on your laptop: tunnels and forwarding, provider test events, replaying real captured payloads, verifying signatures locally, keeping secrets out of your shell history, and deliberately testing failures, timeouts and duplicates. 9 min read Security How to Verify Webhook Signatures in Go, Node.js and Python Verify webhook signatures correctly with HMAC: the raw-body requirement, timestamped signatures and replay windows, constant-time comparison, secret rotation, and working code in Go, Node.js and Python. 10 min read Debugging Webhook Delivered but Not Processed: Common Causes The provider shows a green 200 but nothing happened. Why webhooks are accepted yet never processed: early acknowledgement, queue failures, worker crashes, rolled-back transactions, swallowed exceptions, bad routing, and the observability to find them. 9 min read Idempotency Webhook Idempotency: Preventing Duplicate Payments and Actions Duplicate webhook deliveries are normal, not a bug. How to make handlers idempotent with event IDs, a processed-events table, database uniqueness, correct transaction boundaries, and production Go — so replays and retries never charge a customer twice. 11 min read Reliability Webhook Retry Best Practices: Backoff, Jitter and Attempt Limits How to retry failed webhook deliveries without causing retry storms: fixed vs exponential backoff, jitter, attempt limits, which status codes are retryable, Retry-After, and dead-letter handling. 11 min read
Quick checklists
Short answers for common failures
Compact checklist pages for when you already know the symptom — a failed delivery, a risky replay, a 500 from your handler, a 429 from a burst.
Debug a failed webhook Practical steps to debug a failed webhook: inspect status and response body, verify signatures, rule out timeouts and idempotency, then replay with context. Read →Replay safely How to replay a failed webhook safely: when replay is safe vs risky, idempotency keys, duplicate side effects, verification, and a pre-replay checklist. Read →Webhook 500 errors Diagnose webhook 500 errors: what a 500 means, common backend causes, provider retry behaviour, inspecting the failed response, and safe replay. Read →Stripe retries & idempotency How Stripe webhook retries work (up to three days, exponential back off), why duplicate events happen, and how to dedupe on event ID so retries and replays are safe. Read →Webhook rate limits Handle webhook rate limits and 429s: what 429 means, provider retry behaviour, endpoint rate limits, retry vs drop, and keeping throttled deliveries visible. Read →
Receiver guides
Build a webhook receiver by stack
Minimal, correct receivers that capture the raw body, verify the signature, and acknowledge fast — then point at HookWatch to capture and replay the real deliveries.
Node / Express Build a webhook receiver in Node.js/Express: raw-body capture, HMAC verification, fast 2xx acknowledgement, async processing. Read →Next.js Build a webhook handler in Next.js (App Router route handler): raw body access, signature verification, fast acknowledgement. Read →Go Build a webhook receiver in Go (net/http): raw-body read, constant-time HMAC verification with hmac.Equal, fast acknowledgement. Read →FastAPI Build a webhook receiver in FastAPI (Python): raw body access, hmac.compare_digest verification, BackgroundTasks for async processing. Read →Laravel Build a webhook receiver in Laravel (PHP): exclude the route from CSRF, read the raw body via $request->getContent(), verify with hash_hmac + hash_equals, and queue the work. Read →
Get started
Start debugging your webhooks.
Point one endpoint at HookWatch and see your deliveries — failures included. Free during beta.