Developers
Know the second a post goes live, or doesn't
Signed HTTP callbacks when posts publish, fail or get scheduled, when queues change and when channels need attention, with retries, a delivery log and one-click replay.
Polling an API to find out whether a scheduled post went out is wasteful and slow. Webhooks turn it around: Tesselith calls your URL when something happens. Every request is signed to the Standard Webhooks spec, so you can verify it with the official open-source libraries in a few lines instead of writing HMAC code by hand. Failed deliveries retry on a fixed schedule for about 27 hours. Every attempt is recorded with its status code and response, and you can resend any delivery with the same id so your handler can deduplicate safely.
The events that matter
post.created, post.scheduled, post.published (including partial publishes), post.failed, post.deleted, queue.updated, channel.connected, channel.disconnected and channel.reconnect_required. Subscribe to all of them, or just the ones you need.
Standard Webhooks signatures
Each request carries webhook-id, webhook-timestamp and webhook-signature headers, an HMAC-SHA256 over the id, timestamp and body. Rotate a secret and both the old and new signatures are sent for 24 hours, so you can roll keys with zero downtime.
Retries you can see
Retries at 5 seconds, 5 minutes, 30 minutes, 2 hours, 5 hours, 10 hours and 10 hours. The delivery log shows every attempt with its request, response and timing, and Resend replays any delivery in one click.
Safe by default
Endpoint URLs must be public HTTPS; private, loopback and cloud-metadata addresses are refused at save and at send time. An endpoint that keeps failing for five days is switched off and its owners are emailed, rather than retrying forever.
Questions people ask about webhooks
- How do I verify a Tesselith webhook?
- Use any Standard Webhooks library (JavaScript, Python, Go, Ruby, PHP, Rust, Java, C# and more) with your endpoint's whsec_ secret. Pass it the raw request body and the three webhook-* headers. It checks the signature and rejects requests older than five minutes.
- What's in a webhook payload?
- A small JSON body: the event type, a timestamp, and the ids of what changed, such as post_id. Fetch the object from the API when you need its current state. That way a retried or out-of-order delivery can never hand you stale data.
- Can I test a webhook before going live?
- Yes. Send test event delivers a signed webhook.test request right away and shows the response inline, so you can check your verification code before real events start arriving.