Guides
Practical webhook guides
Step-by-step engineering guides for the webhook problems that page you: failed deliveries, misbehaving retries, duplicate side effects, signature mismatches, and handlers that are hard to test.
Quick checklists
Short answers for common failures
Compact checklist pages for when you already know the symptom — a failed delivery, a risky replay, a 500 from your handler, a 429 from a burst.
Debug a failed webhook Practical steps to debug a failed webhook: inspect status and response body, verify signatures, rule out timeouts and idempotency, then replay with context. Read →Replay safely How to replay a failed webhook safely: when replay is safe vs risky, idempotency keys, duplicate side effects, verification, and a pre-replay checklist. Read →Webhook 500 errors Diagnose webhook 500 errors: what a 500 means, common backend causes, provider retry behaviour, inspecting the failed response, and safe replay. Read →Stripe retries & idempotency How Stripe webhook retries work (up to three days, exponential back off), why duplicate events happen, and how to dedupe on event ID so retries and replays are safe. Read →Webhook rate limits Handle webhook rate limits and 429s: what 429 means, provider retry behaviour, endpoint rate limits, retry vs drop, and keeping throttled deliveries visible. Read →
Receiver guides
Build a webhook receiver by stack
Minimal, correct receivers that capture the raw body, verify the signature, and acknowledge fast — then point at HookWatch to capture and replay the real deliveries.
Node / Express Build a webhook receiver in Node.js/Express: raw-body capture, HMAC verification, fast 2xx acknowledgement, async processing. Read →Next.js Build a webhook handler in Next.js (App Router route handler): raw body access, signature verification, fast acknowledgement. Read →Go Build a webhook receiver in Go (net/http): raw-body read, constant-time HMAC verification with hmac.Equal, fast acknowledgement. Read →FastAPI Build a webhook receiver in FastAPI (Python): raw body access, hmac.compare_digest verification, BackgroundTasks for async processing. Read →Laravel Build a webhook receiver in Laravel (PHP): exclude the route from CSRF, read the raw body via $request->getContent(), verify with hash_hmac + hash_equals, and queue the work. Read →
Get started
Start debugging your webhooks.
Point one endpoint at HookWatch and see your deliveries — failures included. Free during beta.