Reliable webhooks: signature and delivery history
Confirm each event came from ZapZap and see what was delivered, with status and attempt.
Create my accountHow it was before
People receiving the webhook had no way to prove a call came from ZapZap, and there was nowhere to see deliveries and failures.
How it works now
Every delivery carries an HMAC signature per number, in the style used by large payment platforms, with an identifier and a timestamp for you to verify and avoid duplicates. If your server fails, ZapZap retries with growing intervals, and each retry is re-signed with a new timestamp. The Deliveries tab shows the latest deliveries, with event, HTTP status, time and attempt number.
What you gain
- An HMAC signature to prove where the event came from
- Automatic retries with growing intervals
- Identifiers to handle repeated events
- A Deliveries tab with status, time and attempt
Before
Your server had no way to prove the call came from ZapZap, and there was nowhere to see deliveries and failures.
Signature
- Each number has its own signing secret
- Every call carries the signature, the timestamp, the delivery identifier and the event type
- On retries, the signature is rebuilt with a new timestamp
Retries
- If your server fails, ZapZap tries again at growing intervals
- Only after attempts run out does the webhook count as failed
Deliveries
The Deliveries tab lists the latest deliveries with event, HTTP status, response time and attempt number.