Webhook ingester

Receive and verify#

Expose a public HTTPS endpoint that accepts POST requests. Capture raw body bytes and verify the request with the Node.js or PHP SDK before using the event. Place a request body limit on your receiver and reject malformed envelopes.

Persist before acknowledging#

Store the event in a durable inbox with a unique constraint on its id. Commit the record before returning 204 No Content or another 2xx response. If storage is unavailable, return a failure response so Nexiom Connect can retry.

For an event already present in your inbox, acknowledge it successfully without repeating the side effect. An in-memory set is not sufficient because it disappears on restart.

Process asynchronously#

Have a worker read pending inbox records and route by the signed type. Commit the business change and the inbox completion together where possible. If the work calls an external service, pass a stable idempotency key there too.

HTTPS request
  → Verify timestamp and signature
  → Validate event envelope
  → Commit to durable inbox (unique event ID)
  → Respond 204

Background worker
  → Claim pending event
  → Apply idempotent business change
  → Mark event processed

Recover safely#

Record event ID, type, attempt outcome, and processing status without logging secrets. Retry your own failed processing independently from delivery acceptance. A delivery can succeed while your background processing still needs attention.

This guide describes a receiver you build in your application. Nexiom Connect does not currently ship a separate webhook ingester package.