Pre-Launch Checklist

Use this checklist before enabling webhooks in production.

Endpoint

• URL uses https:// and a production domain
• Endpoint is deployed and reachable from the internet
• Endpoint returns 2xx within the timeout window
• Endpoint handles duplicate deliveries (idempotency via event ID)

Security

• Signature verification is implemented and tested
• Verification parses t and v1 from monime-signature
• Verification signs timestamp_rawBody using the raw request body
• HMAC comparison uses constant-time comparison (if applicable)
• Secret or public key is stored securely
• Secret is not logged or exposed in error messages

Configuration

• At least one alert email is configured
• Alert emails go to a monitored inbox
• Custom headers (if used) are correct and validated
• Correct API release and events are selected

Testing

• Test delivery succeeded (check Event Deliveries)
• Verified signature validation with a real delivery
• Tested error handling (invalid signature returns 401)
• Tested idempotency (replay does not cause duplicates)

Monitoring

• Server logs capture webhook requests (without secrets or full payloads)
• Alerts or dashboards track webhook failures
• Team knows where to find Event Deliveries and how to replay

Rollback

• Know how to disable the webhook quickly
• Know how to update the URL if you must change endpoints

Quick disable

If something goes wrong:

1. Go to Developer > Webhooks.
2. Open the webhook.
3. Click Disable.
4. Confirm.

No new deliveries are sent. Scheduled retries are dropped if the webhook is still disabled when they run.

Post-launch

• Monitor Event Deliveries for the first few hours
• Confirm alert emails are received if a failure occurs
• Document the webhook ID and URL for your runbook
• Add the webhook to your incident response playbook

Rollback plan

If the webhook causes issues:

1. Disable immediately.
2. Fix your endpoint.
3. Re-enable or create a new webhook if the URL or secret changed.
4. Replay failed deliveries after fixing.