
Receiver sequence
Verify with an SDK
SetRUBA_WEBHOOK_SECRET to the endpoint secret. Reject verification failures and acknowledge accepted events with a 2xx response.
Verify without a Ruba SDK
Ruba follows Standard Webhooks. Use an available language library or implement the specification. A manual implementation must base64-encode the endpoint secret before signature generation; Ruba SDK helpers handle that detail.Network allowlist
Production and sandbox currently use the same sources:Delivery contract
Diagnose a missing event
- Confirm the delivery appears in Ruba and inspect its status and payload.
- During local work, confirm the tunnel is running.
- Log entry, verification start, verification success, and queue insertion separately.
- Send
curl -vvv -X POST <endpoint>to expose a missing route or redirect. Some frameworks distinguish/foofrom/foo/. - Exclude the public webhook route from login middleware.
403, inspect reverse-proxy and Cloudflare firewall logs. Cloudflare Bot Fight Mode can block valid Ruba requests even when the source IP is allowlisted; disable that mode for the receiver or adjust the relevant security configuration. For signature errors, verify that the exact raw request body is used and that a custom implementation base64-encodes the secret.