Webhooks

Signed notifications, delivered to your own service.

Connect your receiver

Open Webhooks in your workspace, enter a public HTTPS endpoint, and choose event types. Copy the signing secret when it appears; it is never shown again. Use Send test, then refresh the delivery history to inspect the result. Pausing stops delivery until you enable the endpoint again.

Verify every delivery

The x-thin-signature header contains t=TIMESTAMP,v1=HMAC. Compute HMAC-SHA256 using your signing secret and the exact string timestamp.rawBody. Reject timestamps more than five minutes old. Compare equal-length signature buffers in constant time. Verify the raw body before parsing JSON.

{
  "id": "ntf_unique_event_id",
  "type": "batch_done",
  "created_at": "ISO timestamp",
  "data": {
    "message": "Your batch has completed."
  }
}

Retries and deduplication

Return a 2xx status within ten seconds. Failures retry with exponential backoff, starting after 30 seconds, for six total attempts. The event ID stays the same across retries; deduplicate by that ID. Delivery is at least once, including after a worker restart. Failed deliveries can be manually retried. Redirects are refused. Response bodies are not retained.