​

Webhooks

​

Overview

​

Setup

​

Event Types

​

Onboarding

​

Surveys

​

Billing

​

Push

​

Email

​

In-App Messages

​

Journeys

​

Experiments

​

SDK

​

System

​

Payload Structure

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "type": "payment.completed",
  "created_at": "2026-02-19T10:30:00Z",
  "data": {
    "user_id": "usr_123",
    "product_id": "prod_premium",
    "transaction_id": "2000000123456789",
    "subscription_id": "8f14e45f-ceea-4b1c-9c3a-5d2a7f0c1e11",
    "price": 9.99,
    "currency": "USD",
    "platform": "ios"
  }
}

​

Payment completed data

​

Signature Verification

HMAC-SHA256(signing_secret, raw_request_body)

x-appdna-signature: sha256=a1b2c3d4e5f6...

​

Verification Examples

const crypto = require('crypto');

function verifyWebhook(req, signingSecret) {
  const signature = req.headers['x-appdna-signature'];
  if (!signature) return false;

  const expected = 'sha256=' + crypto
    .createHmac('sha256', signingSecret)
    .update(req.rawBody)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Express middleware example
app.post('/webhooks/appdna', express.raw({ type: 'application/json' }), (req, res) => {
  if (!verifyWebhook(req, process.env.APPDNA_WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  console.log(`Received ${event.type}: ${event.id}`);

  // Process the event asynchronously
  processEvent(event).catch(console.error);

  // Respond quickly with 200
  res.status(200).send('OK');
});

import hmac
import hashlib

def verify_webhook(payload: bytes, signature: str, signing_secret: str) -> bool:
    if not signature:
        return False

    expected = 'sha256=' + hmac.new(
        signing_secret.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(signature, expected)

# Flask example
@app.route('/webhooks/appdna', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('x-appdna-signature')
    if not verify_webhook(request.data, signature, WEBHOOK_SECRET):
        return 'Invalid signature', 401

    event = request.get_json()
    print(f"Received {event['type']}: {event['id']}")

    # Process asynchronously (e.g., enqueue to Celery)
    process_event.delay(event)

    return 'OK', 200

require 'openssl'

def verify_webhook(payload, signature, signing_secret)
  return false unless signature

  expected = 'sha256=' + OpenSSL::HMAC.hexdigest(
    'SHA256',
    signing_secret,
    payload
  )

  Rack::Utils.secure_compare(signature, expected)
end

# Sinatra example
post '/webhooks/appdna' do
  payload = request.body.read
  signature = request.env['HTTP_X_APPDNA_SIGNATURE']

  unless verify_webhook(payload, signature, ENV['APPDNA_WEBHOOK_SECRET'])
    halt 401, 'Invalid signature'
  end

  event = JSON.parse(payload)
  puts "Received #{event['type']}: #{event['id']}"

  # Process asynchronously
  ProcessEventJob.perform_async(event)

  status 200
  'OK'
end

​

Retry Policy

​

Best Practices

1. Respond with 2xx quickly. Return a 200 OK as soon as you receive the payload. Process the event asynchronously in a background job or queue. If your endpoint takes too long to respond, the delivery will be marked as failed and retried.
2. Verify signatures on every request. Never process a webhook payload without verifying the x-appdna-signature header. This protects you from forged requests.
3. Handle idempotency. Webhook deliveries can be retried, which means your endpoint may receive the same event more than once. Use the id field to deduplicate events. Store processed event IDs and skip duplicates.
4. Use HTTPS. AppDNA only delivers webhooks to HTTPS endpoints, in every environment (sandbox and development included); an http:// URL is refused when you save the endpoint. The host must resolve to a public address: a URL that does not (a private or loopback address, an internal host name, a host that does not resolve) is refused when you save the endpoint, with the reason, and the same check runs again before every delivery. A redirect is not followed (it counts as a failed delivery). During development, use a tunneling tool like ngrok, which gives a local endpoint a public HTTPS URL.
5. Monitor delivery health. Check the webhook delivery logs in the dashboard periodically. If you see a pattern of failures, investigate your endpoint’s availability and response times.