Reliable, signed and traceable events.

Receive changes to your operation without polling. Each delivery goes through the dedicated queue, saves attempts and carries a verifiable signature.

27 domain events

Sign them all with * or choose only the events that your application actually consumes.

offer.createdoffer.updatedoffer.publishedsegment.createdcoupon.updatedtemplate.updatedschedule.executedmonitor.createdstore.updatedjourney.updatedconversation.closedconversation.replied

Validate before processing

The secret appears only once. Calculate HMAC-SHA256 over the timestamp and the raw body and compare in constant time.

javascript

import { createHmac, timingSafeEqual } from "node:crypto";

const signed = `${timestamp}.${rawBody}`;
const expected = createHmac("sha256", process.env.ACHADU_WEBHOOK_SECRET)
  .update(signed)
  .digest("hex");
const received = signature.replace("sha256=", "");

if (!timingSafeEqual(Buffer.from(expected), Buffer.from(received))) {
  throw new Error("Invalid signature");
}

Durable delivery

Queue independent of the web process.

Up to six attempts for transient failures.

Timeout of 12 seconds per attempt.

History with HTTP status, error and time.

Internal destinations and private addresses are blocked.