Webhooks and signatures

Webhooks tell your systems when a run starts, passes or fails.

Create an endpoint

1. Open Settings, then Webhooks.

2. Add a URL and pick the events you want.

3. Copy the signing secret. It is shown once.

Verify the signature

Every delivery carries a header called cinder-signature. It is an HMAC of the raw body, using your signing secret.

expected = hmac_sha256(secret, raw_body)
compare_constant_time(expected, header)

expected = hmac_sha256(secret, raw_body)
compare_constant_time(expected, header)

expected = hmac_sha256(secret, raw_body)
compare_constant_time(expected, header)

Retries

A delivery that does not return a 2xx status is retried up to five times over six hours. After that it is shown as failed in the delivery log.