HMAC-SHA256-signed event delivery · 5-minute timestamp tolerance

Webhook endpoints

Subscribe to session lifecycle + quota events. Each endpoint gets its own signing secret; verify with the SDK's verifyWebhookSignature helper.

  • https://hooks.example.test/driftstack

    active

    production hook

    whk_00000000-0000-4000-8000-0000000000d1 · created 2026-04-15

    session.completed session.failed quota.warning_80pct
    Delivered
    4,321
    Failed
    12
    DLQ
    1
  • https://staging.example.test/driftstack

    paused

    staging — paused while testing

    whk_00000000-0000-4000-8000-0000000000d2 · created 2026-04-22

    session.completed
    Delivered
    213
    Failed
    0
    DLQ
    0

Failed deliveries retry 5× with exponential backoff before landing in the DLQ. DLQ entries are admin-replayable; no auto-retry past the initial attempts to avoid storm-on-recovery patterns.