Signed webhook delivery
Loading portfolio
AI and automation / 2024
Webhook Relay & Inspector
Debugging provider webhooks usually requires tunnel logs, manual replay, and ad hoc verification. Slow, lossy, and dangerous in production.
FastAPI ingress with HMAC verification on raw bodies, an in-memory event store, three-pane inspector UI, live status panel, replay flow, and rule-driven forwarding. Designed as a teaching artefact for idempotency and event-driven thinking, with a documented PostgreSQL upgrade path.
- Role
- Designer and engineer (solo)
- For
- Independent or academic work
- Stage
- Maintained
Walkthrough
Watch it run
A local run with signed test events from Stripe, GitHub and Shopify: a duplicate delivery recognised, a forged signature rejected, and a stored payload replayed.
My part
What I built
- HMAC verification on the raw request body. No re-serialisation gotchas
- Idempotency keys + bounded retries with delivery-attempt history
- Documented upgrade path from in-memory store to PostgreSQL
Current stage and limits
- Event store is currently in-memory; not durable across restarts.
- Forwarding rules are static. No per-tenant UI for editing rules yet.
- Bounded retries only; no advanced backoff schedules or dead-letter queue.
Technical detailOpen the system view
SYSTEM ARCHITECTURE
Controlled event capture and replay
A debugging utility preserves exact request bytes, validates HMAC signatures, identifies duplicates, streams events to an inspector and replays or forwards them through bounded rules.Exact bytes, headers and signature check
Idempotency and original event history
WebSocket event review
Rules, retries and forwarding
Controlled reproduction endpoint
- 01External providerexact requestRaw ingress
- 02Raw ingressverified captureBounded event store
- 03Bounded event storestreamLive inspector
- 04Bounded event storeselected replayReplay dispatcher
- 05Replay dispatcherbounded attemptTarget service
Built with
Links
More work
Gazelle's KitchenA WhatsApp business gatekeeper that qualifies genuine orders, enforces business and safety rules, contains off-topic or abusive conversations, and only surfaces the small set of cases that genuinely need the owner.PilotSellavie AIAn independent project: multi-tenant conversational-commerce software that connects social messaging with business knowledge, guarded AI, human handoff, orders, billing, analytics and operations.MaintainedAI Automation Control PlaneA runnable multi-tenant control plane for AI-assisted business workflows, combining FastAPI, Next.js, PostgreSQL, Redis, n8n, provider routing, human approval, idempotency, replay, cancellation, audit traces, and deterministic local demonstrations.Maintained