Skip to main content
The delivery view records past attempts, request payloads, failure details, and manual redelivery. Your receiver still needs to preserve the raw body, verify the signature, queue durable work, and return success quickly.

Receiver sequence

Verify with an SDK

Set RUBA_WEBHOOK_SECRET to the endpoint secret. Reject verification failures and acknowledge accepted events with a 2xx response.

Verify without a Ruba SDK

Ruba follows Standard Webhooks. Use an available language library or implement the specification. A manual implementation must base64-encode the endpoint secret before signature generation; Ruba SDK helpers handle that detail.

Network allowlist

Production and sandbox currently use the same sources:
The final two ranges were added on October 27, 2025.

Delivery contract

Diagnose a missing event

  1. Confirm the delivery appears in Ruba and inspect its status and payload.
  2. During local work, confirm the tunnel is running.
  3. Log entry, verification start, verification success, and queue insertion separately.
  4. Send curl -vvv -X POST <endpoint> to expose a missing route or redirect. Some frameworks distinguish /foo from /foo/.
  5. Exclude the public webhook route from login middleware.
For a 403, inspect reverse-proxy and Cloudflare firewall logs. Cloudflare Bot Fight Mode can block valid Ruba requests even when the source IP is allowlisted; disable that mode for the receiver or adjust the relevant security configuration. For signature errors, verify that the exact raw request body is used and that a custom implementation base64-encodes the secret.