HMAC-signed event delivery for every lifecycle in your tenant.
Wire downstream services to react in real time when an api-key rotates, a vault secret changes, an alert triggers, or a billing event fires — without polling. One subscription model, one HMAC-SHA256 signing scheme, one delivery-history audit trail.
Why webhooks deserve their own page
Event delivery isn't a tile in an integrations marketplace.
Most platforms bury webhooks under 'Integrations' alongside Slack and Jira tiles. The result: webhooks get treated like a third-party connector instead of the always-on, signed, retried, audited delivery channel that production integrations actually depend on. Tessarac promotes webhooks to a top-level surface — every lifecycle event in the platform speaks the same envelope, signs with the same scheme, and lands in the same delivery-history view.
- Tenant-scoped subscriptions — every customer sees only their own webhook configuration and delivery history
- HMAC-SHA256 signature on every delivery via the X-Tessarac-Signature header — the receiver verifies before trusting
- Signing secret hashed at rest (sha256, never logged); the cleartext is shown ONCE at create/rotate time
- Replay-safe via X-Tessarac-Event-Id — receivers can dedupe across retries with no extra plumbing
- Full delivery history surfaces last_delivered_at, last_response_status, last_error in both UI and api
One webhook plane. Every Tessarac event.
The same envelope shape, the same signing scheme, the same retry policy applies to every lifecycle Tessarac emits — no per-product rewrite required for receivers.
API key lifecycle
Subscribe to api_key.created, api_key.rotated, api_key.revoked, api_key.expired. Receivers refresh their cached key resolution the moment a customer rotates — no waiting for the next validate.
Vault + secrets
Subscribe to vault.secret.read, vault.secret.write, vault.secret.deleted, vault.lease.expired. Operators see in real time when a high-value secret is read or rotated — no 24-hour audit-log delay.
Alerts + audit
Subscribe to alert.triggered, alert.resolved, audit.event.fired. Pipe to your SOC, your on-call rotation, your Slack channel — but with cryptographic delivery guarantees, not best-effort fan-out.
Billing + lifecycle
Subscribe to billing.purchase, billing.refund, billing.overage, license.updated. Reconciliation jobs and customer notification systems react the moment money moves — no nightly batch lag.
The signing scheme
Verify every delivery in three lines of code.
Tessarac signs the raw request body with HMAC-SHA256 using the subscription's signing secret. The signature lands in the X-Tessarac-Signature header as 'sha256=<hex>'. Constant-time comparison on the receiver — never a string-equals — closes the timing-side-channel hole.
- X-Tessarac-Signature: sha256=<hex of HMAC-SHA256(secret, body)>
- X-Tessarac-Event: api_key.rotated (the canonical event-type label)
- X-Tessarac-Event-Id: a stable id you can dedupe on across retries
- Verifier uses constant-time compare (hmac.equal in Go, crypto.timingSafeEqual in Node, hmac.compare_digest in Python)
- Reference verifiers published for Go, Node, Python, Ruby, and Java
Operator + customer surfaces
Same model on both sides of the line.
Customers manage their own webhook subscriptions in the customer console — create, pause, fire-test, rotate, delete. Operators see every webhook in the tenant from the employee console with the same actions plus tenant-scoped audit. Same DB rows; different URL prefixes; different audit-event names.
- Customer surface: /v1/webhooks (full session, tenant-scoped via the resolved tenant_id)
- Operator surface: /v1/admin/webhooks (admin scope required; tenant-scoped via the operator's tenant context)
- Both surfaces include CRUD + rotate-secret + fire-test + delivery-history endpoints
- Per-API-key webhooks remain available at /v1/admin/applications/{appID}/webhooks for operators wanting per-app focus
Webhooks deserve a dedicated page. So do yours.
Stop burying event delivery under 'Integrations'. Promote it to a first-class surface and give your customers the audit trail and signing guarantees production integrations actually need.