Webhook Channel - Notifyflow

The WEBHOOK channel triggers an HTTP POST request to the target HTTPS URL configured in the recipient field.

Secure Request Verification

To prevent spoofing or unauthorized posts, every webhook payload is signed with a cryptographic signature sent in the request header: x-notifyflow-signature This header contains an HMAC-SHA256 signature generated using a shared Webhook signing secret. You can set this secret in the Settings tab.

Verifying Webhook Signatures

To verify that the webhook request came from Notifyflow, compute the HMAC-SHA256 hash of the raw request body string using your shared secret, and compare it to the signature header.

import crypto from "crypto";

export function verifySignature(req, res, next) {
  const signature = req.headers["x-notifyflow-signature"];
  const rawBody = JSON.stringify(req.body);
  const secret = process.env.NOTIFYFLOW_WEBHOOK_SECRET;

  const hash = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  if (signature === hash) {
    next();
  } else {
    res.status(401).send("Invalid signature header");
  }
}

import hmac
import hashlib

def verify_signature(raw_body_bytes, signature_header, secret):
    # Secret must be key bytes
    secret_bytes = secret.encode('utf-8')
    computed_signature = hmac.new(
        secret_bytes, 
        raw_body_bytes, 
        hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(computed_signature, signature_header)

Retries and Timeouts

Connection Timeout: Webhook workers enforce a 5-second response window. If the target server fails to reply within 5 seconds, the request is considered a failure.
HTTP Failure States: Any status code outside the 2xx range (such as 500 Internal Error or 404 Not Found) is treated as a delivery failure.
Retry Loop: Webhook failures undergo 4 automatic retries using exponential backoff before being marked as dead-letter events.

Developer Implementation

To dispatch webhook events, configure your recipient as the destination webhook listener URL, and pass the event payload in the data parameter:

const response = await fetch("https://notifyflow-api.onrender.com/api/v1/notify", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": process.env.NOTIFYFLOW_API_KEY
  },
  body: JSON.stringify({
    channel: "WEBHOOK",
    recipient: "https://yourdomain.com/webhooks/listener", // Endpoint URL
    rawBody: "Order placed event payload",
    data: {
      event: "order.placed",
      orderId: "ORD-1029",
      amount: 4499,
      timestamp: Date.now()
    },
    priority: "DEFAULT"
  })
});

const data = await response.json();
console.log("Ingested Webhook ID:", data.notificationId);