> ## Documentation Index
> Fetch the complete documentation index at: https://docs.convonexai.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Inbound webhooks

> Receive events from Stripe, GitHub, Slack, and other services — with the sender's signature verified before your app ever sees them.

When your app needs to hear about outside events — a Stripe payment succeeded, a
GitHub push landed, a Slack command was typed — Creator gives it a public
webhook endpoint with the hard part done properly: **every delivery's signature
is verified** before it counts. Unsigned or forged requests are rejected, so
"anyone on the internet can POST fake events at my app" is designed out.

## How it works for you

1. The agent registers a webhook for your project and gets a public URL.
2. You paste that URL into the vendor's dashboard (Stripe → Webhooks, GitHub →
   webhook settings, Slack app config).
3. For vendors with their own signing secret (Stripe, GitHub, Slack), the Infra
   tab shows **Needs your secret** — paste the vendor's signing secret from
   their dashboard into the secure field. For generic senders, the platform
   mints the signing secret for you and the sender signs with it.
4. Verified events are delivered to your app, each carrying a unique delivery ID
   so retries can't be double-processed.

Alternatively, the vendor can point straight at a route in your app that
verifies signatures itself — the agent picks the topology that fits the
integration; either way, verification is never skipped.

## Supported senders

| Sender      | Signature scheme                                             |
| ----------- | ------------------------------------------------------------ |
| **Stripe**  | Stripe's standard signature header, with timestamp tolerance |
| **GitHub**  | GitHub's SHA-256 signature header                            |
| **Slack**   | Slack's signing scheme (signature + timestamp)               |
| **Generic** | HMAC signing with a platform-minted secret                   |

## When something goes wrong

Every delivery is recorded — received when, signature valid or not, delivered or
still retrying. If your app was broken when an event arrived, fix the app and
**replay** the delivery; nothing is lost. Ask the agent to show the delivery
history or pending retries for any webhook.

## Good to know

* Webhook URLs are per-project and rate-limited.
* Signing secrets live in your project's [secret store](/capabilities/secrets) —
  never in code, never visible to the agent as plaintext.
* Verification of a "reject the unsigned request" behavior is exactly the kind of
  promise the [verification system](/verification/what-verified-means) checks —
  a handler that accepts anything fails the check.