# webhook.co

> webhook.co documentation — a free, permanent, signed webhook URL with payload inspection, replay-to-localhost, inbound verification across 144 providers, outbound delivery, and an MCP webhook→agent trigger. Identical across CLI, API, dashboard, and MCP.

## Docs

- [webhook.co](https://docs.webhook.co/introduction.md): A free, permanent, signed ingest URL — inspect every request, verify it, replay it to localhost, deliver it onward. Identical across CLI, API, dashboard, MCP.
- [Quickstart](https://docs.webhook.co/quickstart.md): Create a signed ingest URL, send it a test event, and watch it arrive — then verify it, replay it to localhost, and deliver it onward.
- [Authentication](https://docs.webhook.co/authentication.md): The whk_ API key: bearer auth, scopes and least privilege, dashboard-managed keys, CLI OAuth sign-in, MCP auth, and an https-only base URL.
- [How webhook.co works](https://docs.webhook.co/concepts/how-webhook-co-works.md): The path a webhook takes through webhook.co — ingest, verify, dedup, store, deliver, replay.
- [Ingest URLs](https://docs.webhook.co/concepts/ingest-urls.md): A permanent, signed webhook URL on a dedicated cookieless apex that captures raw bytes durably before it verifies or dedupes.
- [Inbound verification](https://docs.webhook.co/concepts/inbound-verification.md): Register a provider secret and webhook.co verifies each incoming signature over the exact captured bytes, recording a four-value verification state.
- [Delivery, retry & signing](https://docs.webhook.co/concepts/delivery-retry-signing.md): How webhook.co forwards events to SSRF-safe destinations, retries on a fixed schedule, and re-signs only what it verified.
- [Security & architecture](https://docs.webhook.co/concepts/security.md): How webhook.co is built — KMS-sealed secrets, a verifiable audit log, row-level tenant isolation, SSRF-safe egress, and cookieless ingestion.
- [Events and usage](https://docs.webhook.co/events-and-usage.md): Usage is measured in one unit — the event. What a capture and a delivery cost, everything that never counts, and how to check your usage.
- [Troubleshooting reference](https://docs.webhook.co/troubleshooting.md): A compact developer reference for the common webhook.co snags — signature verification, delivery failures, and the questions that come up most — with fixes.
- [Recover a leaked API key](https://docs.webhook.co/leaked-api-key.md): A whk_ key leaked. Revoke it (immediate, and the only remedy), rotate without downtime, and shrink the blast radius before the next one.
- [Receive your first webhook](https://docs.webhook.co/guides/receive-your-first-webhook.md): Create an endpoint, get its permanent signed ingest URL, point a provider or curl at it, and confirm the captured event.
- [Verify inbound signatures](https://docs.webhook.co/guides/verify-inbound-signatures.md): Register a provider's signing secret and let webhook.co verify every inbound request against the exact bytes it received.
- [Manage provider secrets](https://docs.webhook.co/guides/manage-provider-secrets.md): Register, list, and revoke the signing secrets webhook.co uses to verify inbound signatures — and rotate them with zero downtime.
- [Inspect and search events](https://docs.webhook.co/guides/inspect-search-events.md): List, filter, search, read, and tail captured webhook events — by provider, verification state, time range, or free-text — across CLI, API, and SDKs.
- [Replay webhooks to localhost](https://docs.webhook.co/guides/replay-to-localhost.md): Forward captured webhook events to your machine with one command — wbhk listen --forward — and iterate on your handler against real payloads.
- [Replay a past or failed event](https://docs.webhook.co/guides/replay-past-or-failed-event.md): Re-deliver any stored event to your machine or to a registered destination, with a fresh idempotency key and the original bytes intact.
- [Send events to a destination](https://docs.webhook.co/guides/send-to-a-destination.md): Register an HTTPS destination and subscribe a source endpoint to it so captured events forward automatically, with retries and optional FIFO ordering.
- [Sign outbound webhooks](https://docs.webhook.co/guides/sign-outbound-webhooks.md): Enable per-destination Standard Webhooks signing so your receiver can verify a delivery genuinely came from webhook.co, with zero-downtime secret rotation.
- [Handle delivery failures](https://docs.webhook.co/guides/handle-delivery-failures.md): Inspect why an outbound delivery failed, read its retry clock and status, and re-enable a destination that auto-disabled after repeated failures.
- [Deduplication](https://docs.webhook.co/deduplication.md): Collapse a sender's at-least-once retries into a single captured event — per endpoint, by identifier, content, or fields, within a window you choose.
- [Verifying provider webhooks](https://docs.webhook.co/providers/verifying-provider-webhooks.md): How webhook.co picks a signature scheme, the 144-provider registry, automatic handshakes, and the four verification states.
- [Provider directory](https://docs.webhook.co/providers/directory.md): All 144 providers webhook.co verifies, grouped by scheme, with each provider's slug, signature scheme, header, and handshake support.
- [Verify Stripe webhooks](https://docs.webhook.co/providers/stripe.md): Register your Stripe signing secret on an endpoint and webhook.co verifies every inbound event's Stripe-Signature for you.
- [Verify GitHub webhooks](https://docs.webhook.co/providers/github.md): Register your GitHub webhook secret and webhook.co verifies every X-Hub-Signature-256 against the raw payload bytes.
- [Verify Shopify webhooks](https://docs.webhook.co/providers/shopify.md): Register your Shopify webhook secret and webhook.co verifies every X-Shopify-Hmac-Sha256 against the raw payload.
- [Verify Slack webhooks](https://docs.webhook.co/providers/slack.md): Register your Slack signing secret and webhook.co verifies the v0 request signature and answers the url_verification handshake.
- [Verify Braintree webhooks](https://docs.webhook.co/providers/braintree.md): Register your Braintree private key and webhook.co verifies bt_signature and answers the bt_challenge handshake.
- [Verify Adyen webhooks](https://docs.webhook.co/providers/adyen.md): Register your Adyen HMAC key and webhook.co verifies each notification's signature over its signed field set.
- [Verify Square webhooks](https://docs.webhook.co/providers/square.md): Register your Square signature key and webhook.co verifies the HMAC over the notification URL plus the raw body.
- [Verify Twilio webhooks](https://docs.webhook.co/providers/twilio.md): Register your Twilio auth token and webhook.co verifies X-Twilio-Signature over the request URL and parameters.
- [Verify HubSpot webhooks](https://docs.webhook.co/providers/hubspot.md): Register your HubSpot app client secret and webhook.co verifies the v3 request signature over method, URI, body, and timestamp.
- [Verify Meta webhooks (WhatsApp, Messenger)](https://docs.webhook.co/providers/meta.md): Register your Meta app secret and verify token, and webhook.co verifies x-hub-signature-256 and answers the subscription handshake.
- [Verify Contentful webhooks](https://docs.webhook.co/providers/contentful.md): Register your Contentful signing secret on an endpoint and webhook.co verifies every inbound event's signature for you.
- [Verify Discord webhooks](https://docs.webhook.co/providers/discord.md): Register your Discord public key on an endpoint and webhook.co verifies every inbound event's signature for you.
- [Verify DocuSign webhooks](https://docs.webhook.co/providers/docusign.md): Register your DocuSign signing secret on an endpoint and webhook.co verifies every inbound event's signature for you.
- [Verify Klaviyo webhooks](https://docs.webhook.co/providers/klaviyo.md): Register your Klaviyo signing secret on an endpoint and webhook.co verifies every inbound event's signature for you.
- [Verify Mailgun webhooks](https://docs.webhook.co/providers/mailgun.md): Register your Mailgun signing secret on an endpoint and webhook.co verifies every inbound event's signature for you.
- [Verify SendGrid webhooks](https://docs.webhook.co/providers/sendgrid.md): Register your SendGrid public key on an endpoint and webhook.co verifies every inbound event's signature for you.
- [Verify Zendesk webhooks](https://docs.webhook.co/providers/zendesk.md): Register your Zendesk signing secret on an endpoint and webhook.co verifies every inbound event's signature for you.
- [Custom or unlisted provider](https://docs.webhook.co/providers/custom.md): Capture works for any sender. Here's how verification maps to the 144 listed providers and what to do when yours isn't one of them.
- [Develop against real Stripe webhooks locally](https://docs.webhook.co/recipes/stripe-to-localhost.md): Capture verified Stripe webhooks on a permanent URL and forward them to your dev server, replaying any event as often as you like.
- [Drive an AI agent from an endpoint's webhooks](https://docs.webhook.co/recipes/agent-triggers.md): Subscribe an agent to an endpoint over MCP, then run a loop that acts on verified events at a cadence your agent sets.
- [Consolidate webhooks from many providers into one signed stream](https://docs.webhook.co/recipes/fan-in-to-one-service.md): Verify webhooks from several providers, then fan them into a single destination your receiver verifies with one signing secret.
- [Trigger a job on a GitHub webhook](https://docs.webhook.co/recipes/github-actions-trigger.md): Verify GitHub events and auto-deliver only the genuine ones to a destination that kicks off your pipeline.
- [Move an existing receiver behind webhook.co with zero downtime](https://docs.webhook.co/recipes/migrate-existing-receiver.md): Put inspection, replay, and retries in front of a webhook receiver you already run — without changing a line of its code.
- [A reliable e-commerce order pipeline](https://docs.webhook.co/recipes/reliable-order-pipeline.md): Verify Shopify orders, collapse the noisy retries, and deliver each order once to fulfillment with signing and automatic retries.
- [Rotate an outbound signing secret with zero downtime](https://docs.webhook.co/recipes/rotate-signing-secret.md): Roll a destination's Standard Webhooks signing secret through a dual-signature grace window so your receiver never rejects a valid event.
- [Build an idempotent at-least-once consumer](https://docs.webhook.co/recipes/idempotent-consumer.md): Layer inbound dedup, verified-gated delivery, and receiver-side idempotency so a duplicate delivery is a no-op, not a double-charge.
- [Diagnose and recover a failing delivery](https://docs.webhook.co/recipes/debug-a-failed-delivery.md): Find failed and dead deliveries, read the real error, fix the receiver, re-enable it, and replay the events it missed.
- [The tight local webhook dev loop](https://docs.webhook.co/recipes/local-dev-loop.md): Capture a real webhook once, then forward, edit, and replay it into your handler indefinitely — no re-triggering upstream.
- [Give every tenant their own webhook URL](https://docs.webhook.co/recipes/multi-tenant-ingestion.md): One endpoint per tenant, each with its own secret, dedup policy, and destination — so tenant traffic never crosses wires.
- [Get alerted when deliveries start failing](https://docs.webhook.co/recipes/alert-on-delivery-failures.md): Combine built-in auto-disable and owner email with a poll over dead deliveries and usage to build the alert your on-call needs.
- [API reference](https://docs.webhook.co/api-reference/introduction.md): The webhook.co REST API — base URL, bearer auth, the response and error envelope, pagination, and where every endpoint connects to the concepts.
- [The event object](https://docs.webhook.co/reference/the-event-object.md): The shape of a captured event as the API and SDKs return it, plus the Standard Webhooks headers webhook.co adds when it delivers one onward.
- [Errors and status codes](https://docs.webhook.co/reference/errors.md): Every webhook.co error carries a code, an HTTP status, and a request id. How to read them, and how the SDKs surface them as typed errors.
- [Rate limits](https://docs.webhook.co/reference/rate-limits.md): How webhook.co signals throttling — a 429 with Retry-After — and how the SDKs back off and retry automatically.
- [Pagination](https://docs.webhook.co/reference/pagination.md): List endpoints page with opaque keyset cursors — stable under inserts. How to page with the SDKs and the CLI.
- [Delivery and consumption guarantees](https://docs.webhook.co/reference/delivery-guarantees.md): What webhook.co promises about capturing, delivering, and consuming events — durability, at-least-once delivery, ordering, and verified-gated signing.
- [List endpoints](https://docs.webhook.co/api-reference/endpoints/list-endpoints.md)
- [Create an endpoint (returns its ingest URL)](https://docs.webhook.co/api-reference/endpoints/create-an-endpoint-returns-its-ingest-url.md)
- [Get an endpoint](https://docs.webhook.co/api-reference/endpoints/get-an-endpoint.md)
- [Soft-delete an endpoint (idempotent)](https://docs.webhook.co/api-reference/endpoints/soft-delete-an-endpoint-idempotent.md)
- [Update an endpoint's deduplication config (null resets to the default)](https://docs.webhook.co/api-reference/endpoints/update-an-endpoints-deduplication-config-null-resets-to-the-default.md)
- [Rotate an endpoint's ingest token (revokes the old URL, returns the new one)](https://docs.webhook.co/api-reference/endpoints/rotate-an-endpoints-ingest-token-revokes-the-old-url-returns-the-new-one.md)
- [Reveal an endpoint's always-shown ingest URL](https://docs.webhook.co/api-reference/endpoints/reveal-an-endpoints-always-shown-ingest-url.md)
- [List an endpoint's provider secrets (metadata only)](https://docs.webhook.co/api-reference/endpoints/list-an-endpoints-provider-secrets-metadata-only.md)
- [Add a provider signing/verification secret to an endpoint](https://docs.webhook.co/api-reference/endpoints/add-a-provider-signingverification-secret-to-an-endpoint.md)
- [Revoke a provider secret](https://docs.webhook.co/api-reference/endpoints/revoke-a-provider-secret.md)
- [List captured events across the org (optionally one endpoint)](https://docs.webhook.co/api-reference/events/list-captured-events-across-the-org-optionally-one-endpoint.md)
- [List captured events for an endpoint (deprecated, use the org-wide events list)](https://docs.webhook.co/api-reference/events/list-captured-events-for-an-endpoint-deprecated-use-the-org-wide-events-list.md)
- [Pull a watermark-bounded forward page of events (cursor-pull tail)](https://docs.webhook.co/api-reference/events/pull-a-watermark-bounded-forward-page-of-events-cursor-pull-tail.md)
- [Get a captured event](https://docs.webhook.co/api-reference/events/get-a-captured-event.md)
- [Delete a captured event (tombstone: redacts + purges its body; idempotent)](https://docs.webhook.co/api-reference/events/delete-a-captured-event-tombstone:-redacts-+-purges-its-body;-idempotent.md)
- [Get a captured event's raw payload (base64 envelope)](https://docs.webhook.co/api-reference/events/get-a-captured-events-raw-payload-base64-envelope.md)
- [Replay an event to a target (records a delivery attempt)](https://docs.webhook.co/api-reference/events/replay-an-event-to-a-target-records-a-delivery-attempt.md)
- [Verify the org's tamper-evident audit chain](https://docs.webhook.co/api-reference/audit/verify-the-orgs-tamper-evident-audit-chain.md)
- [Get the org's metering usage for the current billing period](https://docs.webhook.co/api-reference/usage/get-the-orgs-metering-usage-for-the-current-billing-period.md)
- [List outbound delivery attempts](https://docs.webhook.co/api-reference/deliveries/list-outbound-delivery-attempts.md)
- [Get a delivery attempt](https://docs.webhook.co/api-reference/deliveries/get-a-delivery-attempt.md)
- [List replay destinations (the SSRF-egress allowlist)](https://docs.webhook.co/api-reference/replay-destinations/list-replay-destinations-the-ssrf-egress-allowlist.md)
- [Register a replay destination (returns a one-time signing secret)](https://docs.webhook.co/api-reference/replay-destinations/register-a-replay-destination-returns-a-one-time-signing-secret.md)
- [Soft-delete a replay destination](https://docs.webhook.co/api-reference/replay-destinations/soft-delete-a-replay-destination.md)
- [Re-enable an auto-disabled replay destination](https://docs.webhook.co/api-reference/replay-destinations/re-enable-an-auto-disabled-replay-destination.md)
- [Toggle strict-FIFO delivery for a destination](https://docs.webhook.co/api-reference/replay-destinations/toggle-strict-fifo-delivery-for-a-destination.md)
- [Rotate a destination's signing secret (returns the new one-time secret)](https://docs.webhook.co/api-reference/replay-destinations/rotate-a-destinations-signing-secret-returns-the-new-one-time-secret.md)
- [List a destination's signing-secret metadata](https://docs.webhook.co/api-reference/replay-destinations/list-a-destinations-signing-secret-metadata.md)
- [List auto-delivery subscriptions](https://docs.webhook.co/api-reference/subscriptions/list-auto-delivery-subscriptions.md)
- [Create (upsert) an auto-delivery subscription](https://docs.webhook.co/api-reference/subscriptions/create-upsert-an-auto-delivery-subscription.md)
- [Delete an auto-delivery subscription](https://docs.webhook.co/api-reference/subscriptions/delete-an-auto-delivery-subscription.md)
- [List agent trigger subscriptions](https://docs.webhook.co/api-reference/triggers/list-agent-trigger-subscriptions.md)
- [Create an agent trigger subscription](https://docs.webhook.co/api-reference/triggers/create-an-agent-trigger-subscription.md)
- [Revoke an agent trigger subscription](https://docs.webhook.co/api-reference/triggers/revoke-an-agent-trigger-subscription.md)
- [Consume the next events for an agent trigger subscription (short-poll)](https://docs.webhook.co/api-reference/triggers/consume-the-next-events-for-an-agent-trigger-subscription-short-poll.md)
- [Return the authenticated principal (org, scopes, optional user)](https://docs.webhook.co/api-reference/identity/return-the-authenticated-principal-org-scopes-optional-user.md)
- [The wbhk CLI](https://docs.webhook.co/cli/overview.md): Install wbhk, sign in, and capture, inspect, and replay webhooks from your terminal — every capability the dashboard has, scriptable.
- [Command reference](https://docs.webhook.co/cli/command-reference.md): Every wbhk command group, subcommand, and flag — auth, endpoints, events, deliveries, listen, replay, destinations, subscriptions, triggers, and more.
- [SDKs](https://docs.webhook.co/sdks/overview.md): Official, typed SDKs for TypeScript, Python, and Go — generated from the OpenAPI contract, with the same hardening built in.
- [TypeScript SDK](https://docs.webhook.co/sdks/typescript.md): @webhook-co/sdk — the official TypeScript SDK.
- [Python SDK](https://docs.webhook.co/sdks/python.md): webhook-co — the official Python SDK.
- [Go SDK](https://docs.webhook.co/sdks/go.md): github.com/webhook-co/webhook-go — the official Go SDK.
- [webhook.co over MCP](https://docs.webhook.co/mcp/overview.md): A pure OAuth resource server exposing 21 scope-gated tools over streamable-HTTP, derived from the same capability contract as the API, CLI, and dashboard.
- [Agent triggers](https://docs.webhook.co/mcp/agent-triggers.md): Subscribe an agent to an endpoint over MCP. Events are held durably; your agent reads what it hasn't seen yet and marks its place with a cursor.
- [Trigger semantics](https://docs.webhook.co/mcp/trigger-semantics.md): The exact triggers.wait contract — short-poll cursor pull, at-least-once via ack-by-cursor, per-endpoint ordering, bounded body inlining, and the API mirror.
- [Connect your MCP client](https://docs.webhook.co/mcp/using-from-a-client.md): Connect any MCP client to webhook.co's remote server at https://mcp.webhook.co/mcp with a whk_ bearer token or interactive OAuth. Per-client configs included.
- [How authorization works](https://docs.webhook.co/mcp/authorization.md): How MCP clients authenticate to webhook.co — a whk_ bearer token or the interactive OAuth flow — plus the consent screen, verified apps, and connected apps.
- [Search these docs from your agent](https://docs.webhook.co/mcp/connect-the-docs-mcp.md): These docs are served over their own MCP endpoint — add docs.webhook.co/mcp to your agent and it can search and retrieve them live.
- [Help center](https://docs.webhook.co/help/overview.md): Answers for using webhook.co — your account, organizations, billing, usage, and security. The developer reference lives one tab over.
- [Getting started](https://docs.webhook.co/help/getting-started/overview.md): New to webhook.co? Start here — what it is, how to create an account, a tour of the dashboard, and the words we use.
- [What webhook.co is](https://docs.webhook.co/help/getting-started/what-is-webhook-co.md): A plain-English introduction to webhook.co — a permanent, signed URL that captures, inspects, replays, and delivers your webhooks.
- [Create an account](https://docs.webhook.co/help/getting-started/create-an-account.md): Sign in with Google, GitHub, or an email link — signing in for the first time creates your account. What the first-run setup asks for.
- [A tour of the dashboard](https://docs.webhook.co/help/getting-started/the-dashboard.md): Where to find your endpoints, events, deliveries, team, and settings in the webhook.co dashboard.
- [Glossary](https://docs.webhook.co/help/getting-started/glossary.md): Plain-English definitions of the words webhook.co uses — endpoint, ingest URL, event, destination, delivery, and more.
- [Your account](https://docs.webhook.co/help/your-account/overview.md): Manage how you sign in, your profile, your sessions, connected apps, and deleting your account.
- [How you sign in](https://docs.webhook.co/help/your-account/sign-in-methods.md): webhook.co signs you in with Google, GitHub, or an email link — there's no password. How to add, switch, and manage your login methods.
- [Sessions & signing out](https://docs.webhook.co/help/your-account/sessions.md): How webhook.co sessions work, and how to sign out — everywhere at once when you need to.
- [Your name & avatar](https://docs.webhook.co/help/your-account/change-your-name.md): Update the display name and picture shown across webhook.co and to your team.
- [Change your email](https://docs.webhook.co/help/your-account/change-your-email.md): Move your webhook.co account to a new email address, verified with a one-time code and safe by design.
- [Connected apps](https://docs.webhook.co/help/your-account/connected-apps.md): Review and revoke the applications you've authorized to access your webhook.co account.
- [Delete your account](https://docs.webhook.co/help/your-account/delete-your-account.md): Permanently erase your webhook.co account and its data, including organizations you solely own. What's removed, and what to do first if you own a shared org.
- [Organizations & members](https://docs.webhook.co/help/organizations/overview.md): Organizations are your workspaces. Create them, invite your team, assign roles, and manage access.
- [Organizations & teams](https://docs.webhook.co/help/organizations/organizations-and-teams.md): An organization is your workspace and the tenant that owns everything. 'Team' is the people in it — not a separate concept.
- [Create an organization](https://docs.webhook.co/help/organizations/create-an-organization.md): Start a new workspace for a team or project — you become its owner and can invite others.
- [Invite & manage members](https://docs.webhook.co/help/organizations/invite-and-manage-members.md): Invite people to your organization by email, assign their role, and remove them when they leave.
- [Roles & permissions](https://docs.webhook.co/help/organizations/roles-and-permissions.md): webhook.co has three roles — owner, admin, and member. What each can do, and how role changes are governed.
- [Rename & change the URL](https://docs.webhook.co/help/organizations/rename-and-url.md): Change an organization's display name and its URL slug. Old URLs keep redirecting, so links never break.
- [Delete an organization](https://docs.webhook.co/help/organizations/delete-an-organization.md): Permanently remove an organization and everything in it. Owner-only, and irreversible.
- [Billing & plans](https://docs.webhook.co/help/billing/overview.md): How pricing works, managing your subscription, invoices, and our refund policy.
- [Plans & pricing](https://docs.webhook.co/help/billing/plans-and-pricing.md): One dimension — events. A free allowance to start, self-serve paid plans with monthly included volume, flat overage, and retention that grows with your plan.
- [Manage your subscription](https://docs.webhook.co/help/billing/manage-your-subscription.md): Upgrade or downgrade your plan, update your payment method, get invoices, and cancel — all self-serve.
- [Refunds](https://docs.webhook.co/help/billing/refunds.md): How refunds and cancellation work at webhook.co — you keep access through the period you've paid for.
- [Usage & limits](https://docs.webhook.co/help/usage/overview.md): What counts as an event, how usage alerts work, what happens at your cap, and how long your data is kept.
- [Usage alerts & caps](https://docs.webhook.co/help/usage/alerts-and-caps.md): webhook.co warns you as you approach your limit, then pauses capture instead of running up a surprise bill. What that looks like, and how to resume.
- [Data retention](https://docs.webhook.co/help/usage/data-retention.md): How long webhook.co keeps your events before they're automatically removed — a window that grows with your plan.
- [Security & privacy](https://docs.webhook.co/help/security/overview.md): How webhook.co protects your data, what we do and don't claim, how your payload data is handled, and how to report a vulnerability.
- [How we protect your data](https://docs.webhook.co/help/security/how-we-protect-your-data.md): Encryption in transit and at rest, KMS-sealed secrets, database-enforced tenant isolation, and SSRF-safe delivery — in plain terms.
- [The audit log](https://docs.webhook.co/help/security/the-audit-log.md): webhook.co keeps a tamper-evident, append-only audit log for your organization that you can cryptographically verify yourself.
- [Your data & privacy](https://docs.webhook.co/help/security/your-data-and-privacy.md): How webhook.co stores your payloads, where your data lives, and your privacy rights — including the parts you should know before sending sensitive data.
- [Compliance](https://docs.webhook.co/help/security/compliance.md): webhook.co's compliance posture, stated plainly — a GDPR Data Processing Agreement and SCCs, and an honest list of the certifications we do not hold.
- [Report a vulnerability](https://docs.webhook.co/help/security/report-a-vulnerability.md): Found a security issue in webhook.co? Report it privately — here's how, and what to expect.
- [Troubleshooting & FAQ](https://docs.webhook.co/help/troubleshooting/overview.md): The common webhook.co problems — webhooks not arriving, delivery failures, signature errors, duplicates, and auth — each with the cause and the fix.
- [My webhooks aren't arriving](https://docs.webhook.co/help/troubleshooting/webhooks-not-arriving.md): A checklist for when events aren't showing up in webhook.co — endpoint state, provider configuration, verification, and your usage cap.
- [A delivery failed](https://docs.webhook.co/help/troubleshooting/delivery-failures.md): The outbound delivery states, what each means, and how to fix them — plus how retries and dead-lettering work.
- [A signature won't verify](https://docs.webhook.co/help/troubleshooting/signature-verification.md): The four verification states, why an inbound signature check fails, and why your own check of webhook.co's outbound signature might not match.
- [Duplicates, ordering & retries](https://docs.webhook.co/help/troubleshooting/duplicates-ordering-and-retries.md): Why you might see the same event twice, why order isn't guaranteed, and how to build a receiver that handles both.
- [Errors & common questions](https://docs.webhook.co/help/troubleshooting/common-errors-and-faq.md): The API and ingest errors you're most likely to hit — 401, 403, 429, and a paused endpoint — plus quick answers to common questions.
- [Get more help](https://docs.webhook.co/help/getting-help/overview.md): Didn't find your answer? How to reach us, what to include, and how webhook.co keeps your events reliable.
- [Contact us](https://docs.webhook.co/help/getting-help/contact-support.md): How to reach webhook.co for help, and what to include so we can resolve your issue quickly.
- [Reliability](https://docs.webhook.co/help/getting-help/reliability.md): How webhook.co protects your events end to end — durable capture, at-least-once delivery, automatic retries, and dead-lettering.
- [Changelog](https://docs.webhook.co/changelog.md): Notable user-facing changes to webhook.co — the API, CLI, SDKs, dashboard, and product, newest first.

## OpenAPI Specs

- [openapi](https://api.webhook.co/openapi.json)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.