Articles
Webhook concepts, explained plainly.
Short answer: Each article answers one question about webhooks and AI agents in its first paragraph, then shows the configuration or code that makes it work.
All articles
What is a webhook gateway?A webhook gateway is a service that sits between webhook providers and your application. It receives each provider's request, verifies the signature, optionally filters or reshapes the payload, then forwards it to your destination with retries and a delivery log. Your app handles one stable contract instead of every provider's quirks.Trigger an AI agent from a webhookTo trigger an AI agent from a webhook, point the provider at a gateway endpoint, filter to the events that matter, render a task payload with a template, and forward it to the agent's HTTP endpoint. The gateway keeps the retries and delivery log, so a temporarily unavailable agent does not lose the event.How to verify a GitHub webhook signatureGitHub signs the raw request body with HMAC-SHA256 using the webhook secret and sends the result in X-Hub-Signature-256 as sha256=<hex>. Compute the same digest over the exact bytes you received, compare it in constant time, and reject the request when they differ. Never verify against a re-serialized JSON object.Stripe webhook retries and idempotencyIf your endpoint does not answer with a 2xx quickly, Stripe retries the delivery with exponential backoff for up to three days. Because any delivery can arrive more than once, store event.id and make the handler idempotent. Acknowledge first, then do the slow work asynchronously.Prevent prompt injection in webhooksA webhook that triggers an AI agent carries attacker-controlled text: issue titles, commit messages, customer notes. Treat it as data, never instructions. Pass only allowlisted fields, keep the task envelope fixed, and require approval before an agent takes an action that can change systems or spend money.Webhook retry strategy that worksA workable webhook retry strategy retries only transient failures (timeouts, 429, 5xx), backs off exponentially with jitter, keeps the same delivery id so the receiver can deduplicate, and stops after a bounded window or attempt count. Permanent failures (400, 401, 404) should not be retried at all.