Configuring Destinations

A Destination is a public HTTPS endpoint attached to a Source. DeadHook signs every attempt with a Destination-specific signing secret.

Requirements

• https:// only;
• public hostname and address; private, local, metadata, reserved, and custom-port targets are rejected;
• no URL credentials;
• timeout between 1,000 and 30,000 ms (default 10,000);
• redirects are not followed;
• the hostname must resolve to a public address when the request is made.

A Destination that does not meet these requirements becomes a terminal policy failure rather than an endless retry loop.

Add a Destination

In the dashboard, open a Source and choose Add Destination:

URL: https://example.com/webhooks/deadhook
Timeout: 10000 ms
Capture response body: off

The Destination signing secret is returned once. Store it on your receiving service and never in frontend code:

export DEADHOOK_DESTINATION_SECRET='whsec_REPLACE_WITH_DESTINATION_SECRET'

Verify outbound signatures

Every attempt includes fresh headers:

content-type: application/json
webhook-id: msg_<delivery-reference>
webhook-timestamp: <unix-seconds>
webhook-signature: v1,<base64-hmac>
x-relay-event-id: <event-uuid>
x-relay-source-id: <source-uuid>
x-relay-attempt: <attempt-number>

The signed content is:

{webhook-id}.{webhook-timestamp}.{raw-body}

Use the base64-decoded Destination secret (whsec_ prefix removed) as the HMAC-SHA256 key. Compare in constant time, reject old timestamps, and deduplicate by webhook-id before applying side effects.

webhook-id is stable across retries of one Delivery (msg_<delivery-reference>), so a consumer can use it as an idempotency key. A replay is a new dispatch cycle but keeps the same Delivery identity; combine webhook-id with your own business key if you need replay to be distinguishable.

Response inspection

Turn on Capture response body only when you need to debug a Destination. Capture is opt-in, bounded, and retained for a limited period. It stores a snippet of the response, not the full body. See HTTP response inspection.

Update, disable, archive

• Update changes the URL, timeout, response-capture setting, or enabled state.
• Disable removes the Destination from new fan-out; existing Deliveries keep their state.
• Archive removes it from the active list and frees its plan slot. Existing accepted Deliveries continue; replay is blocked while archived. See Archive and restore.

Multiple Destinations

Where your workspace and plan support multiple active Destinations, you can add more than one to a Source. Each receives its own independent Delivery. If the option is unavailable, that workspace is limited to one active Destination.