Docs

Setting up sources (receiving webhooks from other services)

Required role and plan

View
Viewer or higher
Add, change, delete, reprocess
Developer or higher
Plan
All plans (sources per organization: Free 1, Starter 5, Pro 20, Business unlimited)

Add a source

  1. Add the customer to deliver to (it can be your own company) and its endpoint.
  2. Open Sources in the menu and select + Add source.
  3. Enter a Name, choose the Provider, and choose Deliver to customer.
  4. Enter the signing secret from the provider. You can leave it empty and set it after registering the URL.
  5. Optionally open Advanced settings to set how the event type is read, a header for de-duplication, headers to forward to endpoints, and the response returned on receipt.
  6. The source’s page opens. Copy the Receiving URL and register it in the provider’s webhook settings.

Providers you can choose

Stripe, GitHub, Shopify, Slack, LINE, Meta (Facebook, WhatsApp, Instagram), Zoom, Standard Webhooks (Clerk, Resend, OpenAI, Replicate and more), HMAC (generic), Basic auth, API key, No verification.

With No verification, anyone who knows the receiving URL can send to it. While no signing secret is set, incoming webhooks are rejected.

Check received requests and reprocess

  1. Open the source and check Received requests. Use Filter by result to show Accepted, Duplicate, Rejected or Held.
  2. For a rejected request, check the reason (for example, the signature does not match). Headers shows the received headers.
  3. After fixing the settings, select Reprocess. For accepted requests, View opens the message.

Only rejected requests whose payload is stored can be reprocessed. Received requests are deleted on the same schedule as message logs. Payloads up to 10 MB are accepted.

Pause, replace the signing secret, delete

  • Pause: requests are still accepted and held while paused. When you select Resume, they are delivered in the order received.
  • Replace the signing secret: for 24 hours after replacing, requests signed with the previous secret are also accepted. After you remove the secret, incoming webhooks are rejected until a new one is set.
  • Delete: the receiving URL stops working and received requests are deleted. Also remove the URL from the provider.

If you exceed your plan’s limit

You cannot add sources beyond the limit. If you move to a plan with a lower limit, the most recently created sources stop accepting requests.