What are webhooks

Webhooks allow CanaryGate to notify your infrastructure when a flag is created, updated, or deleted — without polling.

Use webhooks to:

• Invalidate server-side caches when a flag changes
• Record changes in your own audit system
• Trigger conditional builds or deploys
• Integrate with Slack, PagerDuty, or monitoring systems

Configuration

1. Go to Settings → Webhooks inside the environment
2. Click Add Webhook
3. Enter the endpoint URL (must be HTTPS in production)
4. Select the events you want to receive

Available events

Payload

{
  "event": "flag.enabled",
  "timestamp": "2025-01-15T10:30:00Z",
  "environment": "production",
  "flag": {
    "key": "new-checkout",
    "type": "boolean",
    "enabled": true
  }
}

Security

CanaryGate signs each request with an X-Canarygate-Signature header (HMAC SHA-256). Always validate the signature before processing the payload:

import { createHmac } from 'crypto'
 
function verifyWebhook(payload: string, signature: string, secret: string) {
  const expected = createHmac('sha256', secret).update(payload).digest('hex')
  return signature === `sha256=${expected}`
}

The webhook secret is shown only once upon creation — store it in an environment variable.

Retries

In case of failure (status != 2xx or timeout), CanaryGate retries up to 5 times with exponential backoff. After that, the webhook is marked as failed and you can view the history in the dashboard.