Webhooks

Register HTTPS endpoints in Settings to receive lifecycle events from HTMLDrop.

Events

Payload

{
  "version": "1",
  "id": "delivery-uuid",
  "event": "page.published",
  "createdAt": "2026-08-25T12:00:00.000Z",
  "data": {
    "slug": "demo",
    "url": "https://htmldrop.in/p/demo",
    "format": "html",
    "title": "Demo"
  }
}

Signature verification

Each request includes:

• X-HTMLDrop-Event — event name
• X-HTMLDrop-Signature — HMAC-SHA256 hex digest of the raw JSON body

Verify with your endpoint signing secret:

import { createHmac, timingSafeEqual } from "crypto";

function verifySignature(secret, body, signature) {
  const expected = createHmac("sha256", secret).update(body).digest("hex");
  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Retries

Failed deliveries retry up to 5 times with exponential backoff:

After the fifth failed attempt, the delivery is marked failed (dead-letter). A daily background sweeper processes due retries (included in /api/cron/cleanup). On Vercel Pro you can add a separate /api/cron/webhook-sweep cron every 10 minutes for faster recovery. Check delivery status in Settings.

Related

• API overview
• CI/CD examples