Every inbound channel, one signed event stream.

Delivery you can plan for

• At least once, not in order. Dedupe on id, and order by the times inside data.
• Retried for about two days. If your webhook doesn't answer 2xx, Loods tries again with growing waits, then marks the event failed.
• Never lost to a failure. A failed event stays pullable and redeliverable until it's pruned.
• Kept for 30 days. Keep your own record of anything you need longer.

Verify before you trust

Every event carries a Loods-Signature header: an HMAC-SHA256 over the timestamp and the raw body, with your webhook secret.

function loods_verified(string $body, string $header, string $secret): bool
{
    // t once, v1 one or more times: check the body against every one.
    $parts = [];
    foreach (explode(',', $header) as $part) {
        [$k, $v] = array_pad(explode('=', trim($part), 2), 2, '');
        $parts[$k][] = $v;
    }

    $t = (int) ($parts['t'][0] ?? 0);
    if ($t === 0 || abs(time() - $t) > 300) {
        return false;
    }

    $expected = hash_hmac('sha256', $t.'.'.$body, $secret);
    foreach ($parts['v1'] ?? [] as $candidate) {
        if (hash_equals($expected, $candidate)) {
            return true;
        }
    }

    return false;
}

The contract is the product

You get the full OpenAPI spec and an example of every event and response. Loods tests its own output against those examples; copy them into your tests too.

Errors always have one shape, with a stable code to branch on. Breaking changes get a new version: /v1 is never changed out from under you.