Prototypes SwitchboardP22 · Connections

Sources

Four tools send their events here. Each signs its webhooks its own way, and Switchboard checks each signature before it stores anything. The buttons sign a test event in this browser with the source’s secret, the way the tool itself would, and send it to the source’s address.

Send one from a terminal

GitHub’s scheme, with openssl and curl

The address is outside the portfolio’s login, because a tool cannot type a password. The signature is the check instead. Run this in a terminal to send a push event signed with the Code source’s secret.

How Switchboard is built
  1. Each source has an address outside the portfolio’s login and a secret. The server checks the signature with that secret: Shopify’s HMAC in base64, Stripe’s time and HMAC in hex with 5 minutes of tolerance, GitHub’s HMAC after sha256=, and the Standard Webhooks scheme with an id and a time.
  2. An event is stored once by the id its sender gave it. The same event sent again is answered with 200 and changes nothing, since senders try again when an answer is lost.
  3. The server answers at once and delivers from a Durable Object alarm. Each destination the route names gets its own delivery with its own idempotency key.
  4. A delivery succeeds on an answer in the 200s within 3 seconds. Otherwise it is tried again after 2, 4, 8, 16 and 32 seconds, each pause a fifth longer or shorter at random, so many deliveries that failed together do not come back together.
  5. After 6 tries the delivery waits in the list of failed ones, where a person sends it again with 6 more tries.
  6. A destination applies a delivery once per idempotency key. A slow destination may apply a delivery and answer too late, and the second try is then answered without applying it twice.
  7. Your endpoint, when you set its address, gets a copy of every event, signed with the Standard Webhooks scheme, so it can check that Switchboard sent it.