Plainwork / Catalogue / Webhook Spec Atlas
How 16 webhook senders sign, time out and retry
Signature header, exact signed string, encoding, replay window, response timeout, retry schedule and IP source for each sender, read from the vendor's own docs on 13 Oct 2026, with 15 tested Node verifiers.
- 16 senders as CSV and JSON: Stripe, GitHub, Shopify, Slack, Twilio, SendGrid, Paddle, Square, Zoom, Discord, Svix, Standard Webhooks, Lemon Squeezy, Linear, Twitch, PayPal
- Per sender: header names, scheme, the exact signed string, encoding, secret type, replay window, response timeout, retry schedule, IP source, dedupe id, gotcha, docs link
- webhook-verify.mjs: 15 dependency-free Node verifiers with constant-time compares, plus 23 tests (official vectors for GitHub, Slack and Svix)
- An offline searchable viewer (atlas.html)
- Cells the vendor page did not state are marked "Not stated" instead of guessed (14 such cells)
| Sender | Signed string | Encoding | Timeout | Retries |
|---|---|---|---|---|
| Shopify | <raw body> | base64 | 1 second connection timeout, 5 seconds for the whole request | 8 retries over the next 4 hours; after 8 consecutive failures an Admin API subscription is deleted |
| Slack | v0:<timestamp>:<raw body> | hex, with v0= prefix | Respond 2xx within 3 seconds | Up to 3 retries: nearly immediately, after 1 minute, after 5 minutes (x-slack-retry-num header) |
| Paddle Billing | <ts>:<raw body> | hex | Respond HTTP 200 within 5 seconds | Live accounts: up to 60 retries over 3 days with exponential backoff; exhausted notifications can be replayed via the API |
| Linear | <raw body> | hex | Must respond within 5 seconds with HTTP 200 | 3 retries after 1 minute, 1 hour, then 6 hours; repeated failure disables the webhook |
Get the free 5-row sample CSV (full column set for Stripe, GitHub, Shopify, Slack and Linear). The full Atlas adds the other 11 senders, the verifiers and the viewer. The free article Webhook response timeouts by sender lists the timeouts for all 16 and the retries for those five.
Made for
Who it's for
First-party facts, dated
Every row cites the vendor page and the date it was read. Blog roundups disagree with each other (Shopify retries appear as 48 hours and as 4 hours); Shopify's own page says 8 retries over 4 hours.
Gaps are visible
Where a vendor page is silent on a timeout, retry or IP list, the cell says so. You know what to test instead of trusting a guess.
Code that matches the table
Verifiers use raw bytes and constant-time comparison, enforce documented tolerances, and pass 23 tests, including the official vectors from GitHub, Slack and Svix.
Skip the afternoon of doc-reading
One table instead of sixteen docs sites, so adding the next provider to your webhook module is a copy of a known pattern.
What's inside
Everything you get
How it works
From checkout to done
Buy
Buy and download the folder
Open
Open atlas.html or the CSV to look up a sender
Use
Copy the matching function from webhook-verify.mjs into your receiver and run node --test to see it pass
Questions
Good to know
Where does the data come from?
The vendor's own documentation pages, read on 13 Oct 2026. Each row links its main page, and a second or third page where the fact lives there (for example Square's webhooks overview for timeouts and retries). We did not use blog posts or recall, and cells the vendor pages did not state are marked as such.
Will it stay current?
Vendors change docs, so every row carries its verified date and the README says to re-check before production. Planned updates (more senders, Python and Go ports) are in the changelog; this version is a snapshot.
Is the code tested against real webhooks?
It is tested against the documented algorithms: official test vectors for GitHub, Slack and Svix, openssl-computed fixtures for the other HMAC schemes, and generated key pairs for Discord and SendGrid. We have not tested it against live deliveries from each vendor.
What is free?
The signature debugger runs in your browser at no cost, the 5-row sample CSV (Stripe, GitHub, Shopify, Slack, Linear) is linked on this page, and the free article lists response timeouts for all 16 senders and retry schedules for those five. A standalone MIT verifier for six senders is being published as its own GitHub repository. The Atlas adds the retry schedules for the other 11 senders, the signed-string, replay window, IP source and dedupe columns for all 16, the full set of 15 verifiers and the offline viewer.
Can I use it in client work?
Yes, in any number of your own and client projects. Do not resell the dataset itself as a standalone data product.
What if it doesn't work for me?
If it doesn't work as described or you can't access it, email us within 14 days and we'll fix it or refund you. See the refund policy for details.
Webhook Spec Atlas
16 webhook senders' signing rules, timeouts and retries from vendor docs, plus tested Node verifiers.
More from the catalogue
Other small tools
Foliokit
Seven print-ready document templates and a zero-dependency PDF command: invoice, quote, receipt, statement, letter, certificate and report.
CI OIDC Atlas
11 CI platforms' OIDC token formats, quoted from vendor pages and live discovery documents, with a tested trust-condition builder.
Incident Letter
AI-written customer incident report from your notes. Nothing invented: missing times and causes are marked blanks.