Webhooks

Subscribe an endpoint to events. We sign every delivery; verify it before trusting anything.

Your endpoint

Must be https, and must not resolve to a private network. We refuse those when you subscribe rather than when we deliver, so you find out while you are looking at the form.

Verifying a delivery

Headers: tryme-event-id, tryme-event-type, tryme-signature.

The signature is t=<seconds>,v1=<hex>, an HMAC-SHA256 over timestamp + "." + rawBody using your signing secret. Verify the raw bytes: parsing and re-serialising changes key order, and the signature is over what we sent.

const [t, v1] = header.split(',').map((p) => p.split('=')[1]);
const expected = hmacSha256Hex(secret, `${t}.${rawBody}`);
if (!timingSafeEqual(expected, v1)) return reject();
if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return reject();

Delivery is at-least-once

You will eventually see the same event twice. Deduplicate on tryme-event-id: a handler that ships a sample without checking will one day ship two.

Retries

Any 2xx is success. Anything else is retried 6 times over roughly 19 hours, then given up on. Redirects are not followed. After enough consecutive failures a subscription is disabled, and we tell you why rather than going quiet.