A payment confirmation, a new order, a call status, a release — your providers' webhooks gather at one address. SendNomi verifies the signature and forwards the event cleanly to your own endpoint; anything undelivered queues up and returns with one click. The era of hand-written webhook handlers ends today.
You create a receiver in the panel: choose the source type and paste your provider's shared secret. Enter the SendNomi address generated for you in the provider's webhook settings and the connection is done. The most common signature schemes for payments, code hosting, telephony, e-commerce and CRM are built in; a service not on the list connects via a custom HMAC definition with your own secret and header name.
HMAC-SHA256 HMAC-SHA256 HMAC (URL-aware) HMAC-SHA256 HMAC or OAuth bearer your own secret Every provider has its own HMAC scheme; SendNomi verifies the signature for you. SHA-256 and SHA-1 signatures are supported; the timestamp + nonce check blocks the same request from being replayed. A request that fails verification is rejected with 401, and every event — accepted or rejected — is written to the log. A payload only travels on once its signature passes.
# Send a signed test event — watch the verification live
curl -X POST https://app.sendnomi.com/api/webhooks/inbound/<account-id>/test \
-H "Content-Type: application/json" \
-H "X-Signature: sha256=<signature>" \
-d '{"event":"test","payload":{...}}'
# 200 OK → signature valid, event accepted
# 401 → signature invalid or a replayed request Headers are normalized, the payload is transformed on request, and the event is forwarded to your own endpoint URL. If your endpoint cannot respond right then, SendNomi retries with 3 attempts + exponential backoff and jitter; each attempt is bound to a 30-second timeout. If the same event ID arrives twice, the 24-hour dedup window makes sure it is processed once — your customer never sees a duplicate email or record.
The live event feed lists every webhook with its status: accepted, rejected, delivered, retrying. With the delivery tester you send a test event to your endpoint from the panel and see the response inline. An event that fails all attempts drops into the dead-letter queue; once you fix the issue, you resend it with one click. No event disappears silently.
payment.checkout_completed 200 · delivered order.created 200 · delivered call.status_changed retrying 2/3 release.published dead-letter Send again unknown.source 401 · invalid signature Create your free account — 500 sends per month, forever.