# Pre-Launch Checklist (/docs/developer-resources/guides/webhook/pre-launch-checklist)

Use this checklist before enabling webhooks in production.

## Endpoint

- URL uses `https://` and a production domain
- Endpoint is deployed and reachable from the internet
- Endpoint returns 2xx within the timeout window
- Endpoint handles duplicate deliveries (idempotency via event ID)

## Security

- Signature verification is implemented and tested
- Verification parses `t` and `v1` from `monime-signature`
- Verification signs `timestamp_rawBody` using the raw request body
- HMAC comparison uses constant-time comparison (if applicable)
- Secret or public key is stored securely
- Secret is not logged or exposed in error messages

## Configuration

- At least one alert email is configured
- Alert emails go to a monitored inbox
- Custom headers (if used) are correct and validated
- Correct API release and events are selected

## Testing

- Test delivery succeeded (check Event Deliveries)
- Verified signature validation with a real delivery
- Tested error handling (invalid signature returns 401)
- Tested idempotency (replay does not cause duplicates)

## Monitoring

- Server logs capture webhook requests (without secrets or full payloads)
- Alerts or dashboards track webhook failures
- Team knows where to find Event Deliveries and how to replay

## Rollback

- Know how to disable the webhook quickly
- Know how to update the URL if you must change endpoints

## Quick disable

If something goes wrong:

1. Go to Developer > Webhooks.
2. Open the webhook.
3. Click Disable.
4. Confirm.

No new deliveries are sent. Scheduled retries are dropped if the webhook is still disabled when
they run.

## Post-launch

- Monitor Event Deliveries for the first few hours
- Confirm alert emails are received if a failure occurs
- Document the webhook ID and URL for your runbook
- Add the webhook to your incident response playbook

## Rollback plan

If the webhook causes issues:

1. Disable immediately.
2. Fix your endpoint.
3. Re-enable or create a new webhook if the URL or secret changed.
4. Replay failed deliveries after fixing.