> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bijection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signed webhooks

> Resources, examples, configuration and evidence for Signed webhooks.

Use the `@bijection/connectors/webhooks` entrypoint to declare Signed webhooks resources.

## Availability

This page describes the pinned source package. Published availability is unestablished for this artifact. [Source build and package availability](https://docs.bijection.com/client/sdk-distribution.md).

## Resources and modes

| Resource | Mode | Description |
| - | - | - |
| stripe | `signed` | Signed delivery |
| svix | `signed` | Signed delivery |
| workos | `signed` | Signed delivery |
| authorizeNet | `signed` | Signed delivery |
| square | `signed` | Signed delivery |
| ebay | `signed` | Signed delivery |

Declare a resource in application code, then bind deployment-specific settings and credentials. See [typed resources](https://docs.bijection.com/integrations/resources.md), [connections](https://docs.bijection.com/integrations/connections.md) and [source inspection](https://docs.bijection.com/integrations/cli.md).

## stripe

### signed: Signed delivery

The following example matches configuration `standard`.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { webhooks } from "@bijection/connectors/webhooks";
export const listener = webhooks.stripe.signed();
```

> **Inferred record types**
>
> ```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> Resource without an operational record table
> ```

#### Configuration: standard

Case: `webhooks/stripe/signed/standard`.

Connection and resource configuration are declared by this exact case.

Credential kind: Unspecified. Keep credential material in the private credential inventory.

Inspect the complete configuration contract below for settings and conditional requirements.

> **Complete configuration contract**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "setup": [],
>   "resource": null,
>   "connection_setup": null,
>   "execution": null
> }
> ```

Native admission analysis has not been recorded for this artifact. Declared configuration does not establish native guarantees or provider behavior.

**Recorded checks**

| Requirement | Scope | Evidence | Result |
| - | - | - | - |
| listener-duplicate-delivery | \{"kind":"listener","collection":null} | Native test: integrations/listeners/stripe\_resend\_verifies\_by\_delivery\_timestamp\_and\_deduplicates\_by\_event\_id (shared\_engine) | Execution result unavailable |
| listener-custody-before-ack | \{"kind":"listener","collection":null} | Native test: integrations/listeners/webhook\_delivery\_commits\_responsibility\_before\_acknowledging (shared\_engine) | Execution result unavailable |

Hosted qualification: **unestablished for this catalog configuration**. Installed connections report their own identity, authority and current status.

## svix

### signed: Signed delivery

The following example matches configuration `standard`.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { webhooks } from "@bijection/connectors/webhooks";
export const listener = webhooks.svix.signed();
```

> **Inferred record types**
>
> ```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> Resource without an operational record table
> ```

#### Configuration: standard

Case: `webhooks/svix/signed/standard`.

Connection and resource configuration are declared by this exact case.

Credential kind: Unspecified. Keep credential material in the private credential inventory.

Inspect the complete configuration contract below for settings and conditional requirements.

> **Complete configuration contract**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "setup": [],
>   "resource": null,
>   "connection_setup": null,
>   "execution": null
> }
> ```

Native admission analysis has not been recorded for this artifact. Declared configuration does not establish native guarantees or provider behavior.

**Recorded checks**

| Requirement | Scope | Evidence | Result |
| - | - | - | - |
| listener-duplicate-delivery | \{"kind":"listener","collection":null} | Native test: integrations/providers/resend\_a\_svix\_delivery\_is\_verified\_under\_a\_derived\_key (shared\_engine) | Execution result unavailable |
| listener-custody-before-ack | \{"kind":"listener","collection":null} | Native test: integrations/listeners/postgres\_webhook\_process\_kill\_between\_acceptance\_and\_publication\_recovers (shared\_engine) | Execution result unavailable |

Hosted qualification: **unestablished for this catalog configuration**. Installed connections report their own identity, authority and current status.

## workos

### signed: Signed delivery

The following example matches configuration `standard`.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { webhooks } from "@bijection/connectors/webhooks";
export const listener = webhooks.workos.signed();
```

> **Inferred record types**
>
> ```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> Resource without an operational record table
> ```

#### Configuration: standard

Case: `webhooks/workos/signed/standard`.

Connection and resource configuration are declared by this exact case.

Credential kind: Unspecified. Keep credential material in the private credential inventory.

Inspect the complete configuration contract below for settings and conditional requirements.

> **Complete configuration contract**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "setup": [],
>   "resource": null,
>   "connection_setup": null,
>   "execution": null
> }
> ```

Native admission analysis has not been recorded for this artifact. Declared configuration does not establish native guarantees or provider behavior.

**Recorded checks**

| Requirement | Scope | Evidence | Result |
| - | - | - | - |
| listener-duplicate-delivery | \{"kind":"listener","collection":null} | No retained WorkOS delivery exercises millisecond timestamps with redelivery. | Execution result unavailable |
| listener-custody-before-ack | \{"kind":"listener","collection":null} | Native test: integrations/listeners/webhook\_delivery\_commits\_responsibility\_before\_acknowledging (shared\_engine) | Execution result unavailable |

Hosted qualification: **unestablished for this catalog configuration**. Installed connections report their own identity, authority and current status.

## authorizeNet

### signed: Signed delivery

The following example matches configuration `standard`.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { webhooks } from "@bijection/connectors/webhooks";
export const listener = webhooks.authorizeNet.signed();
```

> **Inferred record types**
>
> ```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> Resource without an operational record table
> ```

#### Configuration: standard

Case: `webhooks/authorizeNet/signed/standard`.

Connection and resource configuration are declared by this exact case.

Credential kind: Unspecified. Keep credential material in the private credential inventory.

Inspect the complete configuration contract below for settings and conditional requirements.

> **Complete configuration contract**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "setup": [],
>   "resource": null,
>   "connection_setup": null,
>   "execution": null
> }
> ```

Native admission analysis has not been recorded for this artifact. Declared configuration does not establish native guarantees or provider behavior.

**Recorded checks**

| Requirement | Scope | Evidence | Result |
| - | - | - | - |
| listener-duplicate-delivery | \{"kind":"listener","collection":null} | No Authorize.Net delivery has reached this declaration; its HMAC-SHA512 verifier has unit tests against a third-party vector only. | Execution result unavailable |
| listener-custody-before-ack | \{"kind":"listener","collection":null} | Native test: integrations/listeners/webhook\_delivery\_commits\_responsibility\_before\_acknowledging (shared\_engine) | Execution result unavailable |

Hosted qualification: **unestablished for this catalog configuration**. Installed connections report their own identity, authority and current status.

## square

### signed: Signed delivery

The following example matches configuration `standard`.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { webhooks } from "@bijection/connectors/webhooks";
export const listener = webhooks.square.signed();
```

> **Inferred record types**
>
> ```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> Resource without an operational record table
> ```

#### Configuration: standard

Case: `webhooks/square/signed/standard`.

Connection and resource configuration are declared by this exact case.

Credential kind: Unspecified. Keep credential material in the private credential inventory.

Inspect the complete configuration contract below for settings and conditional requirements.

> **Complete configuration contract**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "setup": [],
>   "resource": null,
>   "connection_setup": null,
>   "execution": null
> }
> ```

Native admission analysis has not been recorded for this artifact. Declared configuration does not establish native guarantees or provider behavior.

**Recorded checks**

| Requirement | Scope | Evidence | Result |
| - | - | - | - |
| listener-duplicate-delivery | \{"kind":"listener","collection":null} | No Square delivery has reached this declaration; its URL-signed verifier has unit tests against Square's published vectors only. | Execution result unavailable |
| listener-custody-before-ack | \{"kind":"listener","collection":null} | Native test: integrations/listeners/webhook\_delivery\_commits\_responsibility\_before\_acknowledging (shared\_engine) | Execution result unavailable |

Hosted qualification: **unestablished for this catalog configuration**. Installed connections report their own identity, authority and current status.

## ebay

### signed: Signed delivery

The following example matches configuration `standard`.

```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
import { webhooks } from "@bijection/connectors/webhooks";
export const listener = webhooks.ebay.signed();
```

> **Inferred record types**
>
> ```ts theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> Resource without an operational record table
> ```

#### Configuration: standard

Case: `webhooks/ebay/signed/standard`.

Connection and resource configuration are declared by this exact case.

Credential kind: Unspecified. Keep credential material in the private credential inventory.

Inspect the complete configuration contract below for settings and conditional requirements.

> **Complete configuration contract**
>
> ```json theme={"theme":{"light":"github-light-default","dark":"github-dark-default"}}
> {
>   "setup": [],
>   "resource": null,
>   "connection_setup": null,
>   "execution": null
> }
> ```

Native admission analysis has not been recorded for this artifact. Declared configuration does not establish native guarantees or provider behavior.

**Recorded checks**

| Requirement | Scope | Evidence | Result |
| - | - | - | - |
| listener-duplicate-delivery | \{"kind":"listener","collection":null} | No eBay notification has reached this declaration; its ECDSA verifier has unit tests against eBay's published vector only. | Execution result unavailable |
| listener-custody-before-ack | \{"kind":"listener","collection":null} | Native test: integrations/listeners/webhook\_delivery\_commits\_responsibility\_before\_acknowledging (shared\_engine) | Execution result unavailable |

Hosted qualification: **unestablished for this catalog configuration**. Installed connections report their own identity, authority and current status.

## Provider guidance

Compiled declaration examples and configuration details are published in the [connector reference](https://docs.bijection.com/integrations/connectors/index).

Each recipe states only public signature facts: where the delivery identity,
timestamp and signature are, the digest and the tolerance. Install the signing
secret privately with the source listener control; it never appears in code.
Intake verifies the signature, commits custody of the delivery and only then
acknowledges it; a redelivery with the same identity creates no second
occurrence. Read event fields with `ctx.occurrence.read(...)` while processing.

Signing-credential rotation keeps the retiring credential valid for a bounded
overlap; see the listener lifecycle documentation for the rotation control.

`authorizeNet`, `square` and `ebay` admit occurrences under their providers'
own schemes. Authorize.Net's `X-ANET-Signature: sha512=<HEX>` is an
HMAC-SHA512 of the body under the Signature Key as text, identified by
`notificationId` (the element and key reading come from independent
integrations, not from Authorize.Net's documentation). Square signs the
subscription's notification URL followed by the body, so register exactly the
URL the listener reports; `event_id` identifies an event. eBay signs its compact
JSON serialization of the message with ECDSA P-256/SHA-1 under a key read per
`kid` through the collection's eBay connection, and its destination challenge is
answered from the verification token installed as the listener's signing
credential; `notification.notificationId` identifies a message. None of these
has received a delivery from its provider; the verifiers pass the providers'
published vectors (Authorize.Net: a third-party vector) in the platform's unit
tests.

## Provider references

Provider references and prerequisites are maintained in the connector guidance above. No separate provider-documentation review date is recorded.

## Source and evidence

[Canonical connector source](https://github.com/bijectionhq/component-support/blob/b632604330ce9cbcfe17a5a680ef4fbe80f6f672/packages/connectors/src/connectors/webhooks/README.md), [native analysis](https://github.com/bijectionhq/component-support/blob/b632604330ce9cbcfe17a5a680ef4fbe80f6f672/packages/connectors/contract-analysis.json) and [check receipts](https://github.com/bijectionhq/component-support/blob/b632604330ce9cbcfe17a5a680ef4fbe80f6f672/packages/connectors/evidence.json).

Connector artifact: `905888ea276a2a28e36981a79e8142b2547ea451c3e63162cb6915ad4a7d1305`.

The resource declaration examples above are compiled and compared with exact catalog declarations. Recorded checks apply only to their source, declaration and runtime identities. Configure a connection and inspect its status to establish deployment-specific readiness.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.