testland/webhook-delivery-tester
Use whenever webhooks need tests, on the sending or receiving side: HMAC-SHA256 signatures, retries with backoff and jitter, timestamp replay windows, ordering, dead letters and body encoding per Standard Webhooks, plus replaying captured inbound payloads with tampering and key rotation cases.
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
vendor-payloads-and-retries.mdreferences/
Webhook retry schedules and per-vendor payloads
Reference data for webhook-delivery-tester. The core signing, verification,
and replay test code stays in SKILL.md; this file holds the lookup table and
per-vendor specifics that do not need to sit in the workflow spine.
Canonical retry schedule
Per Standard Webhooks, senders retry with exponential backoff plus jitter, capped at N attempts, then dead-letter. A typical delay schedule:
| Attempt | Delay |
|---|---|
| 1 | immediate |
| 2 | 5s |
| 3 | 5min |
| 4 | 30min |
| 5 | 2h |
| 6 | 5h |
| 7 | 10h |
| 8 | (give up; dead-letter) |
Sender retry tests assert the attempt count and the backoff deltas between
attempts (Step 3 in SKILL.md). Dead-letter tests assert that after the max
attempts the webhook is recorded in a dead-letter store and not retried.
Per-vendor sample payloads
For receiver tests of specific vendors, use the vendor's official sample payloads (or captures from their webhook tester), never hand-rolled fixtures - field names drift from real sends.
- Stripe: stripe.com/docs/webhooks -> "Sample events"
- Twilio: twilio.com/docs/usage/webhooks -> per-resource event docs
- SendGrid: docs.sendgrid.com/for-developers/tracking-events
- GitHub: docs.github.com/en/webhooks -> per-event payload reference
- GitLab: docs.gitlab.com/ee/user/project/integrations/webhook_events.html