Webhook Sender

Outbound signed webhooks

@bijectionhq/webhook-senderby bijectionhq

Markdown ▾

View Markdown Download MarkdownOpen in ChatGPT ↗Open in Claude ↗Open in Perplexity ↗

Bijection source

git clone https://github.com/bijectionhq/webhook-sender.git
cd webhook-sender
git checkout 872d4ed78b85dd9ecec12b05823e0722fefbe437

Bijection repository access is required. Request access.

Description

Outbound signed webhooks

Explore the package README for API concepts, configuration, and examples. Check the Bijection source for adaptation-specific setup.

Available to evaluate

Review the source and its dependencies before adopting this package. Source availability does not establish npm publication or runtime qualification.

Getting started

Get the source at the revision above and read its package documentation.
Check the required Bijection SDK version, dependencies, and external service credentials.
Follow the package setup instructions and the guide to using components.
Exercise the component in your deployment according to your project’s verification rules.

Open source

Maintained source: bijectionhq/webhook-sender. Based on TimpiaAI/convex-webhook-sender. License: MIT. Consult the repository for license terms, notices, and contributor attribution.

From the upstream publisher

Managed webhook delivery system for Convex — queue outbound webhooks with retries, exponential backoff, HMAC signing, and delivery tracking

Explore the demo ↗

Upstream overview

From the upstream package documentation.

A Convex component that handles reliable outbound webhook delivery with HMAC-SHA256 signing, automatic retries with exponential backoff, and comprehensive delivery tracking. It provides a managed queue system that handles webhook failures, rate limiting, and provides full audit trails of delivery attempts. Developers get a production-ready webhook infrastructure without building retry logic, signature generation, or delivery monitoring from scratch.

Use cases

From the upstream package documentation.

E-commerce order notifications - Send order status updates to third-party fulfillment services with guaranteed delivery and retry logic for failed attempts
User event streaming - Notify external analytics platforms, CRMs, or marketing tools when users complete actions like signups or purchases
System integration webhooks - Connect your Convex app to payment processors, notification services, or other SaaS tools that expect webhook callbacks
Multi-tenant webhook delivery - Build SaaS products where each customer can register their own webhook endpoints with isolated delivery tracking
Compliance and audit requirements - Maintain detailed logs of all webhook delivery attempts with timestamps and status codes for regulatory compliance

How it works

From the upstream package documentation.

The component uses Convex's component architecture to provide a WebhookSender class that manages destinations and queued deliveries. You register webhook URLs with registerDestination() which returns a signing secret, then send webhooks using the send() method with a destination ID, event type, and payload.

Webhooks are delivered as HTTP POST requests with Standard Webhooks-compatible headers including webhook-signature for HMAC-SHA256 verification. The component handles automatic retries with configurable exponential backoff windows and supports both parallel and serialized delivery modes per destination.

Delivery tracking is built-in through methods like getWebhookStatus() and getDeliveryHistory() which provide full audit trails of delivery attempts. The component also includes a verifyWebhookSignature() utility function for webhook recipients to validate incoming signatures using the whsec_ prefixed secrets.

Upstream package FAQ

How does convex-webhook-sender handle webhook signing?

The convex-webhook-sender component uses HMAC-SHA256 signing with Standard Webhooks compatible secrets prefixed with 'whsec_'. It automatically adds webhook-signature headers and includes verification utilities for recipients to validate webhook authenticity.

What retry logic does this webhook component provide?

The component automatically retries webhooks on 5xx status codes and network failures using exponential backoff. You can configure maxRetries and retryWindowMs per destination, with parallel or serialized (FIFO) delivery modes available.

Can I track webhook delivery status and failures?

Yes, convex-webhook-sender provides complete delivery tracking through getWebhookStatus(), getDeliveryHistory(), and getFailedWebhooks() methods. The component logs all delivery attempts with status codes, timestamps, and error details for comprehensive monitoring.

Does this component support rate limiting for webhooks?

The convex-webhook-sender component includes per-destination rate limiting with configurable requests per second. This prevents overwhelming webhook endpoints while maintaining reliable delivery through the built-in retry mechanism.

Use with agents and CLI

View Skill

Give your coding agent the component’s source identity and setup guidance.

agent-prompt.md

Help me integrate Webhook Sender with Bijection.

Read: https://bijection.com/components/webhook-sender/SKILL.md

Check SDK compatibility and dependency availability.
Follow this project's execution and verification rules.

Download SKILL.md llms.txt

Upstream README.md

View repository ↗

Documentation from TimpiaAI/convex-webhook-sender, recorded October 23, 2026. APIs and setup may differ in the Bijection adaptation.

convex-webhook-sender

Managed webhook delivery for Convex

HMAC signing • Automatic retries • Exponential backoff • Delivery tracking

View Demo • Documentation • API Reference

A Convex component for managed outbound webhook delivery with HMAC signing, retries, exponential backoff, and delivery tracking.

Features

HMAC-SHA256 signing with whsec_ prefixed secrets (Standard Webhooks compatible)
Automatic retries with exponential backoff (configurable max retries & window)
Delivery modes: parallel (default) or serialized (FIFO per destination)
Delivery tracking: full attempt history with status codes and errors
Signature verification utility for webhook recipients

Installation

npm install convex-webhook-sender

Setup

In your convex/convex.config.ts:

import { defineApp } from "convex/server";
import webhookSender from "convex-webhook-sender/convex.config";

const app = defineApp();
app.use(webhookSender);
export default app;

Create the client in a helper file like convex/webhooks.ts:

import { WebhookSender } from "convex-webhook-sender";
import { components } from "./_generated/api";

export const webhooks = new WebhookSender(components.webhookSender);

Usage

Register a destination

// convex/myFunctions.ts
import { mutation } from "./_generated/server";
import { webhooks } from "./webhooks";

export const addWebhookEndpoint = mutation({
  args: { url: v.string() },
  handler: async (ctx, args) => {
    const { destinationId, secret } = await webhooks.registerDestination(ctx, {
      url: args.url,
      maxRetries: 5,
      retryWindowMs: 24 * 60 * 60 * 1000, // 24 hours
    });
    // Share `secret` with the recipient for signature verification
    return { destinationId, secret };
  },
});

Send a webhook

export const onOrderCreated = mutation({
  handler: async (ctx) => {
    await webhooks.send(ctx, {
      destinationId: "...",
      eventType: "order.created",
      payload: { orderId: "123", total: 99.99 },
    });
  },
});

Query delivery status

export const checkWebhook = query({
  args: { webhookId: v.string() },
  handler: async (ctx, args) => {
    return await webhooks.getWebhookStatus(ctx, args.webhookId);
  },
});

Verify signatures (recipient side)

import { verifyWebhookSignature } from "convex-webhook-sender";

// In your webhook handler (e.g., Express, Next.js API route)
const isValid = await verifyWebhookSignature(
  rawBody,
  {
    "webhook-id": req.headers["webhook-id"],
    "webhook-timestamp": req.headers["webhook-timestamp"],
    "webhook-signature": req.headers["webhook-signature"],
  },
  "whsec_your_secret_here"
);

API

`WebhookSender` class

Method	Description
`registerDestination(ctx, config)`	Register a new webhook URL. Returns `{ destinationId, secret }`
`removeDestination(ctx, id)`	Deactivate a destination
`updateDestination(ctx, id, updates)`	Update destination config
`send(ctx, { destinationId, eventType, payload })`	Queue a webhook for delivery
`getDestination(ctx, id)`	Get destination details
`listDestinations(ctx, options?)`	List all destinations
`getSigningSecret(ctx, id)`	Get the HMAC signing secret
`getWebhookStatus(ctx, id)`	Get webhook delivery status
`getDeliveryHistory(ctx, destId, options?)`	Get delivery attempt history
`getFailedWebhooks(ctx, destId, options?)`	Get failed webhooks

Webhook payload format

Webhooks are delivered as HTTP POST with:

POST <destination_url>
Content-Type: application/json
webhook-id: msg_<webhook_id>
webhook-timestamp: <unix_seconds>
webhook-signature: v1,<base64_hmac_sha256>

{"type":"<event_type>","timestamp":<unix_seconds>,"data":<payload>}