Webhook Provider

Emit events to customer endpoints reliably, securely, and observably. Consuming webhooks is covered by idempotent-financial-workflows. Signing formulas and event schema template are in REFERENCE.md.

Payload Signing

• Sign: HMAC-SHA256(secret, "v1:" + timestamp + ":" + raw_body)
• Header: X-Webhook-Signature: t=<unix_ts>,v1=<hex_digest>
• Timestamp in the signed string prevents replay attacks.
• Dual-secret verification during rotation (old + new accepted for 24 h).
• Ed25519 option: publish a public key — customer verifies without a shared secret.

Delivery & Retry

• Success = any 2xx within timeout (30 s recommended).
• Retry on 4xx (except 410), 5xx, timeout, network error.
• Backoff + jitter: 30 s → 5 min → 30 min → 2 h → 8 h → 24 h.
• After max retries: dead-letter queue + dashboard + optional alert.
• On 410: auto-disable the endpoint. Never retry 2xx.