Events that survive your worst Monday.
Every SabNode event — message received, order created, flow completed, payment captured — is delivered to your endpoint with HMAC-SHA256 signing, exponential backoff retries, replay-on-demand and a per-subscription dead-letter queue. Inbound webhooks accept Shopify, Razorpay, Meta and arbitrary provider payloads with first-class signature verification.
- HMAC-SHA256 signing on every delivery
- 24-hour exponential-backoff retry window
- DLQ with one-click replay
- Per-subscription secret rotation
Webhooks are where reliability promises die
You set up a webhook in five minutes and it works. Six months later your endpoint is 5xx-ing for thirty seconds during a deploy and the partner has lost 4,000 events. You email support, they tell you events are "best effort", and you spend a weekend stitching together a replay job from CSV exports of their internal logs.
The second pain is signing. The partner ships an HMAC secret. You write the verifier yourself. A week later someone discovers your verifier compares strings non-constant-time and your endpoint is vulnerable to timing attacks. Or you find out the partner does not sign the timestamp, so a captured request can be replayed forever. Each of these has happened on real production systems.
The third is observability. Inbound webhooks from Shopify, Razorpay, Meta and a dozen other providers land in your codebase. You have no per-provider dashboard, no replay button, no way to find "the 12 events that failed last Tuesday at 14:32". SabNode's webhook system was designed by an engineer who has been on the wrong end of every one of these.
Webhooks, in depth.
Outbound webhooks subscribe to any SabNode event — message.created, conversation.assigned, contact.updated, order.shipped, payment.captured, flow.completed and dozens more. You choose the events, the endpoint URL and an optional set of filters (only events on contacts in segment X, only orders over ₹5,000). SabNode signs every request with HMAC-SHA256 over the body and timestamp, includes a sabnode-signature header and a sabnode-event-id, and expects a 2xx response within 5 seconds.
Retries follow an exponential backoff curve: 30s, 2m, 10m, 30m, 1h, 4h, 12h, 24h, with full jitter. After the final retry, the event lands in the subscription's dead-letter queue. The DLQ in the SabNode dashboard shows the payload, the response your endpoint returned, the timestamps and a one-click replay button. You can also bulk-replay everything from a given hour, useful after a deploy outage.
Inbound webhooks are a first-class object. You can mount an inbound URL per provider (Shopify, Razorpay, Meta, custom), paste the provider's signing secret, and SabNode handles signature verification and replay-protection before the payload hits any of your flows. Inbound payloads can trigger flows, write fields to contacts or call REST API mutations — without you running a single line of glue code.
Secrets rotate cleanly. Each subscription has a primary and an optional next secret. During rotation, deliveries are signed with both; you cut over the verifier when ready and retire the old secret. No bang-and-pray secret swaps at 2 AM.
Everything you get with Webhooks.
HMAC-SHA256 signing
Every outbound request includes a sabnode-signature header with HMAC-SHA256 over `${timestamp}.${body}`. The 5-minute timestamp tolerance defeats replays. Constant-time comparison is documented in every SDK.
Exponential backoff
Retries follow 30s, 2m, 10m, 30m, 1h, 4h, 12h, 24h with full jitter. Total window is 24 hours. The schedule is documented and unchanged release-over-release so your runbooks are stable.
Dead-letter queue
After final retry, events land in a per-subscription DLQ. The UI shows payload, your response, headers and timestamps. One-click replay or bulk-replay-by-hour pulls the events back through your endpoint.
Filtered subscriptions
Subscribe to events with filters: only contacts in segment X, only orders over ₹5k, only conversations on the priority queue. Filters run in SabNode, so your endpoint only gets the events it cares about.
Inbound receivers
Mount a SabNode-hosted URL per provider. We verify Shopify HMAC, Razorpay signature, Meta X-Hub-Signature and custom HMAC schemes before the event triggers a flow or writes a contact.
Secret rotation
Each subscription holds a primary and a next secret. During rotation, outbound deliveries are signed with both so you can flip the verifier without downtime, then retire the old secret.
Delivery observability
Per-subscription dashboards show throughput, success rate, p95 latency and failure breakdown. Alerts fire when failure rate breaches a threshold you set (default: 5% over 15 minutes).
Built for the way teams actually work.
Real-time data warehouse
A SaaS streams every conversation.assigned, message.created and flow.completed event into BigQuery via a Cloud Run receiver. The DLQ saved them during a 14-minute warehouse outage — 4,200 events replayed cleanly.
PagerDuty escalation
A merchant sets a filtered subscription on conversation.priority="urgent" → PagerDuty. The on-call engineer is paged inside 90 seconds of a high-value angry customer landing in the queue.
Shopify return webhook
A D2C brand mounts an inbound Shopify webhook for refunds.created. The flow triggered by that webhook posts a soft-recovery message to the customer and adds a frequent-returner tag for downstream filtering.
CRM bidirectional sync
A B2B team mirrors contacts both ways between Salesforce and SabNode using outbound contact.updated webhooks and a Salesforce Apex receiver. Idempotency keys derived from the event ID make double-fires safe.
Compliance ledger
A fintech subscribes to message.created and writes every send and receive to an append-only S3 bucket for regulatory archive. The webhook signature is preserved in the archive for non-repudiation.
From signup to first send in minutes.
Webhooks is included on every SabNode workspace. No separate billing, no extra setup — flip it on from your workspace settings.
- 01
Create a subscription
Pick events, endpoint URL and optional filters. SabNode mints a signing secret and shows a curl sample for verification.
- 02
Verify signatures
Your endpoint reads sabnode-signature, computes HMAC-SHA256 over timestamp+body, compares constant-time and acks 200.
- 03
Process idempotently
sabnode-event-id is unique per logical event. Dedupe on it so a retry from our side is never a double-write on yours.
- 04
Watch the dashboard
Delivery rate, p95 latency and DLQ depth show in the subscription dashboard. Alerts fire on failure thresholds.
- 05
Replay if needed
After an outage, open the DLQ and click bulk-replay-by-hour. Events flow back through your endpoint in the original order.
Works with the tools you already ship on.
Connect directly with your existing stack, or use the platform APIs and webhooks to extend it natively.
- Shopify
- Razorpay
- Meta
- Stripe
- AWS Lambda
- Vercel
- Cloudflare Workers
- PagerDuty
Platform core tools
Enhance this feature with deep integrations into our core infrastructure. Connect via API, use webhooks, or embed directly with our SDKs.
Unified dashboard apps
Manage every setting inside one workspace UI.
Developer APIs and webhooks
Extend functionality with custom automated workflows.
What happens if my endpoint is down for an hour?
How do I verify the signature in Node.js?
Are deliveries ordered?
Can I subscribe to events for one workspace but not others?
What payload format do you send?
How do I handle a renamed event type?
Can I get webhooks at the edge?
Stronger when stacked.
Ship webhooks into production this week.
No credit card. No sales call required. Spin up a workspace, plug in a number, and your team is live in under an hour.