A webhook is an HTTP POST request sent by a platform when an event occurs. A webhook delivery is a single attempt to send that request to your endpoint. A delivery log records every attempt, including the HTTP response code and timestamp. Webhook monitoring means automatically polling these delivery logs and alerting when a delivery fails — because platforms retry silently for hours before notifying you.
Webhook Monitoring Glossary
Webhook failures are subtle. The terminology around them is precise but rarely explained in one place. This glossary covers the key terms used in webhook delivery, failure detection, and monitoring — as they apply to Stripe, Shopify, and GitHub.
Webhook
An HTTP callback — a POST request sent by one application to a URL you specify when a specific event occurs. Instead of polling an API to check for updates, webhooks push event data to your endpoint the moment something happens. Stripe sends a webhook when a payment succeeds. Shopify sends one when an order is placed. GitHub sends one when someone pushes code.
Webhook delivery
A single attempt to send a webhook event from the source platform to your endpoint. Each delivery attempt is recorded in the platform's delivery log with the HTTP response code your endpoint returned, the timestamp, and the outcome (succeeded or failed). If your endpoint returns a non-2xx status or times out, the delivery is marked failed.
Delivery log
A record maintained by Stripe, Shopify, or GitHub showing every webhook delivery attempt — including event type, timestamp, HTTP response code, response body, and delivery status. Stripe retains delivery logs for 30 days. GitHub retains logs for 72 hours. Shopify retains recent delivery history. These logs are the primary data source for webhook monitoring.
Webhook endpoint
The URL on your server that receives webhook events. When you register a webhook on Stripe, Shopify, or GitHub, you provide this URL. The platform sends HTTP POST requests to this URL when events occur. Your endpoint must respond with a 2xx HTTP status within the platform's timeout window (30 seconds for Stripe, 5 seconds for Shopify, 10 seconds for GitHub).
Failed delivery
A webhook delivery attempt where your endpoint returned a non-2xx HTTP status code, timed out, or was unreachable. A failed delivery triggers the platform's retry schedule. Common causes: your server returned a 500 error, the handler timed out processing a slow operation, an expired SSL certificate caused the connection to fail, or a deployment made the endpoint temporarily unreachable.
Exponential backoff
A retry strategy where the wait time between successive retry attempts increases exponentially. Stripe uses exponential backoff for webhook retries: the gaps between retries start at minutes and grow to hours, with 11 total attempts over 72 hours. The rationale is to give transient failures time to self-recover without overwhelming a struggling endpoint with constant retries.
Webhook retry
A subsequent delivery attempt after a failed delivery. Stripe retries up to 11 times over 72 hours. Shopify retries up to 19 times over 48 hours. GitHub does not retry at all. Retries happen automatically and silently — no alert is sent during the retry window. If all retries fail, Stripe sends a notification email; Shopify deletes the webhook subscription.
Webhook replay
Manually re-triggering a specific webhook delivery after a failure. Stripe, Shopify, and GitHub all provide a redeliver button in their dashboards and a redeliver API endpoint. Replaying re-sends the original event payload to your endpoint. Webhook Guardian includes a one-click replay link in every Slack failure alert so you can trigger the redeliver without opening a dashboard.
Webhook signature
An HMAC hash computed from the webhook payload using a shared secret, sent as an HTTP header (Stripe: Stripe-Signature, Shopify: X-Shopify-Hmac-SHA256, GitHub: X-Hub-Signature-256). Your endpoint should verify this signature before processing the payload to confirm the request came from the platform and was not tampered with. A signature verification failure that returns 401 will trigger retries.
Webhook idempotency
Designing webhook handlers so that processing the same event multiple times produces the same result as processing it once. Because platforms retry failed deliveries, your endpoint may receive the same event more than once. An idempotent handler checks whether the event has already been processed (using the event ID) before taking action. Stripe provides a unique event ID on every event object for this purpose.
Delivery timeout
The maximum time a platform waits for your endpoint to respond before marking the delivery failed. Stripe: 30 seconds. Shopify: 5 seconds. GitHub: 10 seconds. If your handler performs slow operations (database writes, external API calls) synchronously, it will frequently time out. The fix is to return 200 immediately and process the event asynchronously in a background job.
Webhook subscription
A registered webhook configuration on a platform — the combination of an endpoint URL and a set of events to listen for. After 19 consecutive failed deliveries, Shopify automatically deletes the webhook subscription without notification. If this happens, you must re-register the subscription and events that fired during the failure window are lost. Active webhook monitoring catches failures before the subscription is deleted.
Read-only OAuth
An OAuth authorization flow that grants an application read access to specific resources without write permissions. Webhook Guardian connects to Stripe, Shopify, and GitHub via read-only OAuth — it can read delivery logs but cannot create, modify, or delete webhooks, customer data, orders, or any other resource. The OAuth token can be revoked at any time from the platform's settings.
Webhook monitoring
The practice of automatically polling webhook delivery logs and alerting on failures in near real-time. Because platforms retry failed webhooks silently for hours before notifying you, webhook monitoring bridges the gap — detecting failures within minutes by actively reading the delivery log API rather than waiting for the platform's delayed notification.
Monitor webhook delivery failures automatically. Start free for 14 days — connect Stripe, Shopify, or GitHub and get alerted within 5 minutes of any failed delivery.