Drıftstack docs
Docs

Webhook endpoints: create, test, signing secret, retries

You might be here because: “how do I set up a webhook” · Must start with https:// · “Copy this signing secret now” · “Test event sent. Check your server and the delivery log” · “webhook not firing” · “Review undelivered” · “my endpoint got disabled” · “Old secret valid until” · “Pick at least one event” · “This endpoint was probably created, but its signing secret couldn’t be shown” · “signature verification fails”

Short answer

Dashboard → Webhooks: create an endpoint with an https URL and at least one event, then copy the signing secret — it is shown once. Press Send test to confirm your server receives and verifies a delivery. A failed delivery is retried up to 5 times with increasing delays, then marked undelivered and kept in the delivery log, where you can replay it.

Check first

  • Does your server answer 2xx within 10 seconds? Anything else is a failed attempt.
  • Is the endpoint active? A paused endpoint holds its deliveries, and a test on it is refused.
  • Verifying with the current secret, with a correct clock? Deliveries are signed and timestamped; the SDK helper rejects any more than 5 minutes old.
  • From code, managing webhooks needs a full-access key; in a team owner’s workspace, the admin role too.

Likely causes and fixes

  1. Create is refused. “URL is required.”, Must start with https://, “Pick at least one event.”. An endpoint takes at most 10 events, an account at most 10 endpoints — paused ones count, so delete one to free a place.

  2. “This endpoint was probably created, but its signing secret couldn’t be shown because the request timed out.” Delete it and create a new one.

  3. Lost the secret. Press Rotate: the new secret is shown once, and the old one keeps working until “Old secret valid until” — 24 hours, during which every delivery carries both signatures. A reminder email arrives when a secret is 60 days old.

  4. Deliveries failing. The delivery log shows each delivery’s status (pending, in flight, delivered, failed, undelivered), the last response status and body excerpt, and the last error. Retries run after 1, 5, 15, 30 and 60 minutes; after the sixth failed attempt the delivery is undelivered. Fix: repair your server, then press Replay on each; it is re-sent within about a minute. If a replay’s outcome is unknown, check the log before replaying again.

  5. The endpoint disabled itself. After 50 consecutive failed deliveries it is disabled for good; create a new endpoint. The Delivered / Failed / Undelivered counts and “Review undelivered” link on the card show it coming.

  6. Maintenance. Set the endpoint inactive: queued and new deliveries are held, never counted as failures; resuming delivers them. Deleting an endpoint fails its pending deliveries.

If it still fails

Press Talk to a person in this chat (or open Help) and include: endpoint id, delivery id, event type, the last error shown and the times. Support can also requeue undelivered deliveries.