> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getruba.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Build a Reliable Webhook Receiver
> Verify signatures, acknowledge quickly, and recover from delivery failures
export const RubaSocials = () => {
if (typeof document === "undefined") {
return null;
}
const inject = () => {
const footer = document.getElementById("footer");
if (!footer || document.getElementById("ruba-socials")) {
return false;
}
const isDark = document.querySelector("html.dark") || document.querySelector('html[class*="dark"]');
const lineColor = isDark ? "#383838" : "#e8e8ed";
const iconColor = isDark ? "#8e8e93" : "#86868b";
const markColor = isDark ? "#ffffff" : "#08080c";
const hoverColor = "#0071e3";
const div = document.createElement("div");
div.id = "ruba-socials";
div.style.cssText = `display:flex;align-items:center;gap:20px;padding-top:20px;margin-top:20px;border-top:1px solid ${lineColor};width:100%`;
const logo = `Ruba`;
const spacer = ``;
const ig = ``;
const li = ``;
const x = ``;
const github = ``;
div.innerHTML = logo + spacer + ig + li + x + github;
footer.appendChild(div);
return true;
};
if (!document.documentElement.dataset.rubaSocialsObserver) {
document.documentElement.dataset.rubaSocialsObserver = "true";
const observer = new MutationObserver(() => {
if (!document.getElementById("ruba-socials")) {
inject();
}
});
observer.observe(document.body, {
childList: true,
subtree: true
});
}
setTimeout(() => {
if (!inject()) {
const interval = setInterval(() => {
if (inject()) {
clearInterval(interval);
}
}, 500);
setTimeout(() => clearInterval(interval), 10000);
}
}, 300);
return null;
};
The delivery view records past attempts, request payloads, failure details, and manual redelivery. Your receiver still needs to preserve the raw body, verify the signature, queue durable work, and return success quickly.
## Receiver sequence
```text theme={"system"}
Ruba request → raw body + headers → signature verification → durable queue → 2xx response
```
### Verify with an SDK
Set `RUBA_WEBHOOK_SECRET` to the endpoint secret. Reject verification failures and acknowledge accepted events with a 2xx response.
```typescript icon="square-js" TypeScript with Express theme={"system"}
import express, { Request, Response } from 'express'
import { validateEvent, WebhookVerificationError } from '@getruba/sdk/webhooks'
const app = express()
app.post('/webhook', express.raw({ type: 'application/json' }), (req: Request, res: Response) => {
try {
const event = validateEvent(
req.body,
req.headers,
process.env['RUBA_WEBHOOK_SECRET'] ?? '',
)
// Queue event for processing.
res.status(202).send('')
} catch (error) {
if (error instanceof WebhookVerificationError) {
return res.status(403).send('')
}
throw error
}
})
```
```python Python with Flask theme={"system"}
import os
from flask import Flask, request
from ruba.webhooks import validate_event, WebhookVerificationError
app = Flask(__name__)
@app.route('/webhook', methods=['POST'])
def webhook():
try:
event = validate_event(
body=request.data,
headers=request.headers,
secret=os.getenv('RUBA_WEBHOOK_SECRET', ''),
)
# Queue event for processing.
return "", 202
except WebhookVerificationError:
return "", 403
```
### Verify without a Ruba SDK
Ruba follows [Standard Webhooks](https://www.standardwebhooks.com/). Use an available [language library](https://github.com/standard-webhooks/standard-webhooks/tree/main/libraries) or implement the [specification](https://github.com/standard-webhooks/standard-webhooks/blob/main/spec/standard-webhooks.md). A manual implementation must base64-encode the endpoint secret before signature generation; Ruba SDK helpers handle that detail.
## Network allowlist
Production and sandbox currently use the same sources:
```text theme={"system"}
3.134.238.10
3.129.111.220
52.15.118.168
74.220.50.0/24
74.220.58.0/24
```
The final two ranges were added on October 27, 2025.
## Delivery contract
| Condition | Ruba behavior | Receiver design |
| ------------------------------------- | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| Network error or non-success response | Up to 10 attempts with exponential backoff | Make processing idempotent |
| No response within 10 seconds | Attempt is timed out and retried | Queue work and answer within 2 seconds |
| 10 consecutive non-2xx deliveries | Endpoint is disabled and an organization admin is emailed | Fix it, then re-enable it in [webhook settings](https://getruba.com/to/dashboard/settings/webhooks) |
| 3xx response | Treated as failure; redirects are not followed | Register the final URL |
## Diagnose a missing event
1. Confirm the delivery appears in Ruba and inspect its status and payload.
2. During local work, confirm the tunnel is running.
3. Log entry, verification start, verification success, and queue insertion separately.
4. Send `curl -vvv -X POST ` to expose a missing route or redirect. Some frameworks distinguish `/foo` from `/foo/`.
5. Exclude the public webhook route from login middleware.
For a `403`, inspect reverse-proxy and Cloudflare firewall logs. Cloudflare Bot Fight Mode can block valid Ruba requests even when the source IP is allowlisted; disable that mode for the receiver or adjust the relevant security configuration. For signature errors, verify that the exact raw request body is used and that a custom implementation base64-encodes the secret.
The delivery view records past attempts, request payloads, failure details, and manual redelivery. Your receiver still needs to preserve the raw body, verify the signature, queue durable work, and return success quickly.
## Receiver sequence
```text theme={"system"}
Ruba request → raw body + headers → signature verification → durable queue → 2xx response
```
### Verify with an SDK
Set `RUBA_WEBHOOK_SECRET` to the endpoint secret. Reject verification failures and acknowledge accepted events with a 2xx response.