Create a webhook endpoint for a server URL that can receive HTTPS requests, verify signatures over the raw body, deduplicate events, and return promptly. Subscribe only to the event families your integration needs.

​
Create an endpoint

The signing secret is shown only through the controlled endpoint-creation flow. Store it in a secret manager, rotate it deliberately, and never send it to the browser.

​
Operate the endpoint

Use endpoint retrieval and event history to diagnose delivery. Disable an endpoint only after routing is replaced or incident response requires it. When changing the URL, deploy the receiver first, then update the endpoint and verify a test event.

​
Handler contract

Verify authenticity and replay protection before parsing. Insert the event ID into a unique store, enqueue slow business work, and acknowledge only after the request passed authentication and schema checks. See Webhook operations for retries and reconciliation.