Webhook response timeouts by sender, and how the big ones retry
If your webhook endpoint is slow or down, what happens next depends entirely on who is sending. This table lists how long each of 16 senders says it waits for your response, read from the sender's own documentation on 13 October 2026, and the retry schedule for the five most common senders (Stripe, GitHub, Shopify, Slack and Linear). Where a vendor page does not say, the cell says "Not stated on the page read" rather than repeating a number from a blog post. Several widely shared roundups contradict each other here: one lists Shopify retries as lasting 48 hours, another as 4 hours, while Shopify's own page says 8 retries over the next 4 hours.
| Sender | Must respond within | Retries | Source docs |
|---|---|---|---|
| Stripe | Return 2xx quickly before complex logic (no number given) | Live mode: up to 3 days, exponential backoff. Sandbox: 3 retries over a few hours | vendor page |
| GitHub | 10 seconds, then the delivery is recorded as failed | No automatic redelivery; redeliver manually or via the API | vendor page, more 1, more 2 |
| Shopify | 1 second connection timeout, 5 seconds for the whole request | 8 retries over the next 4 hours; after 8 consecutive failures an Admin API subscription is deleted | vendor page |
| Slack | Respond 2xx within 3 seconds | Up to 3 retries: nearly immediately, after 1 minute, after 5 minutes (x-slack-retry-num header) | vendor page, more 1 |
| Twilio | Defaults: 5 seconds to connect, 15 seconds per response read, 15 seconds total; configurable with URL overrides (ct, rt, tt). Voice call requests have a hard 15-second limit | In the Webhook Spec Atlas | vendor page, more 1 |
| SendGrid (Twilio) Event Webhook | Not stated on the page read | In the Webhook Spec Atlas | vendor page, more 1, more 2 |
| Paddle Billing | Respond HTTP 200 within 5 seconds | In the Webhook Spec Atlas | vendor page |
| Square | 10 seconds to respond to a notification before a duplicate event is sent (webhooks overview) | In the Webhook Spec Atlas | vendor page, more 1 |
| Zoom | Respond 2xx within 3 seconds (3 seconds also for the endpoint.url_validation challenge) | In the Webhook Spec Atlas | vendor page |
| Discord (Interactions endpoint) | Send the initial interaction response within 3 seconds of receiving the event, or the interaction token is invalidated (tokens otherwise valid 15 minutes) | In the Webhook Spec Atlas | vendor page, more 1 |
| Svix (also used by Clerk, Resend and others) | 2xx within 15 seconds (Svix) | In the Webhook Spec Atlas | vendor page |
| Standard Webhooks (spec) | Recommended request timeout of 15 to 30 seconds (spec guidance for senders) | In the Webhook Spec Atlas | vendor page |
| Lemon Squeezy | Not stated on the page read | In the Webhook Spec Atlas | vendor page, more 1 |
| Linear | Must respond within 5 seconds with HTTP 200 | 3 retries after 1 minute, 1 hour, then 6 hours; repeated failure disables the webhook | vendor page |
| Twitch EventSub (webhook transport) | Respond within a few seconds (no number); too many failures set status notification_failures_exceeded | In the Webhook Spec Atlas | vendor page, more 1 |
| PayPal | Listener must answer 2xx on HTTPS port 443 | In the Webhook Spec Atlas | vendor page |
What to do with this
- Acknowledge first, work later. Shopify allows 5 seconds in total, Slack 3, Zoom 3, Discord 3, Paddle 5, Linear 5, Square 10, GitHub 10. Verify the signature, write the event to a queue, return 2xx, and process afterwards.
- Do not assume a retry will save you. GitHub does not redeliver failed deliveries automatically, and Slack stops after 3 retries within about 6 minutes. Others retry for days (Stripe up to 3 days). Plan a reconciliation job for the senders that give up.
- Make handlers idempotent. Retries and at-least-once delivery mean duplicates. Shopify sends X-Shopify-Webhook-Id, GitHub sends X-GitHub-Delivery, Svix sends svix-id, Square puts event_id in the body.
- Retries get new signatures. Stripe generates a new timestamp and signature for each retry, so a stored payload will fail a strict replay window.
The Webhook Spec Atlas has the retry schedules for all 16 senders, plus the signature scheme, exact signed string, encoding, replay window, IP source and dedupe id for each, and tested Node verifiers. See the Atlas, grab the free 5-row sample CSV, or use the free webhook signature debugger to check a signature that fails right now.