Blog
Guides on webhook testing, debugging, and forwarding.
What a 5xx From Your Webhook Handler Actually Triggers
Your handler returns a 500 and the sender doesn't give up — it retries, on a schedule you don't control. Here's what actually happens after that response leaves your server, and how to write a handler that survives it.
How to Fan Out One Webhook to Multiple Destinations
One webhook often needs to reach more than one system: your app, a Slack alert, and an analytics pipeline. Here is how to fan a single incoming webhook out to several destinations without building a queue.
PayPal IPN vs Webhooks: Which One Should You Verify
PayPal sends order notifications two different ways: IPN, a legacy postback format, and Webhooks, a modern signed REST format. Here is how to verify each one correctly and when to use which.
Why Twilio Webhook Signatures Fail in Production Handlers
A correct X-Twilio-Signature check can still fail in production because of a rewritten URL, an early body parse, or a trailing slash. Here's exactly how Twilio builds the signature, what breaks it, and how to test your handler against a real captured request.
Verifying Shopify Webhooks: Fixing the Raw-Body HMAC Bug
A Shopify webhook that fails HMAC verification with the right secret is almost always a raw-body problem, not a crypto problem. Here's the exact bug, the fix in PHP, and how to test it without guessing.
Preventing Webhook Replay Attacks With a Timestamp Window
A valid webhook signature does not mean the request is new — it could be a captured one being replayed hours later. Here is how a timestamp window stops that, how wide to set it, and what Stripe and Slack do differently than GitHub.
How to Verify Stripe Webhook Signatures the Right Way
Most Stripe signature bugs come from reading the body wrong, not from a bad secret. Here's the exact verification steps, why it fails silently, and how to test it against a real event instead of a fixture.
How to Design Webhook Payloads Customers Can Trust
The payload shape you pick on day one is the shape you're stuck supporting once a customer builds against it. Here's how to structure the envelope, version events safely, and avoid the retry bugs that only show up in production.
How to Rotate a Webhook Signing Secret With Zero Downtime
Flipping a leaked or expiring webhook secret in one step breaks every incoming delivery until your new code deploys. Here is how to rotate it with a short dual-secret window instead, and how to confirm the new secret works before you cut over.
How to Monitor Webhook Delivery Success Rate in Production
Webhooks fail quietly. Here is what to log per delivery attempt, how to set an alert threshold that catches real problems without paging you for noise, and how exponential backoff decides when to give up.
How to Diagnose a Failing Webhook Endpoint with an AI Agent
A webhook endpoint that stops delivering rarely tells you why. CanHook's MCP connector lets an AI agent read the endpoint config, the last captured request, and the relay delivery log, then explain the actual failure in plain language.
Webhook Fires But Nothing Happens? It's Probably a Content-Type Mismatch
A webhook can return 200 and still never reach your business logic. The usual cause is a Content-Type mismatch between what the sender posted and what your handler expects. Here's how to spot it and fix it for good.
How to Replay Captured Webhooks to Your Local Dev Server
Skip the tunnel. Capture a real webhook once with a hosted catch URL, then replay the exact payload to localhost every time you need to re-trigger it while you debug.
How to Handle Slack's URL Verification Handshake and 3-Second Rule
Slack won't deliver real events until your endpoint echoes back a verification challenge, and every event after that needs a response within 3 seconds. Miss either one and Slack quietly disables your subscription. Here's exactly what to send back and when.
How to Handle Duplicate Webhook Deliveries and Retries
Your webhook sender doesn't know if you received its request, so it sends it again. This guide shows how to make a handler idempotent so duplicate webhook deliveries never double-charge, double-email, or double-anything a customer.
How to Verify GitHub Webhook Signatures with HMAC-SHA256
GitHub signs every webhook delivery with an HMAC-SHA256 digest in the X-Hub-Signature-256 header. Here is how to verify it correctly in Node.js and PHP, and the mistakes that make verification fail for reasons that have nothing to do with your secret.
How to Transform a Webhook Payload Before Forwarding
A webhook payload rarely matches what your downstream service expects. See how CanHook relay rules rebuild or filter the body before forwarding, with real template and filter config examples included.
How to Test and Debug Webhooks: A Developer's Guide
A practical guide to catching, inspecting, and debugging webhooks — from isolating delivery failures to forwarding to multiple services.