Setup
To begin receiving real-time event notifications via webhooks, visit Create a webhookEvent Ordering
Slash cannot guarantee the sequential delivery of events as they occur, nor can it ensure they will be received only once. Most events are generally received in the order in which they occurred; however, events created in close proximity may be received out of order. In the case that an event is received multiple times theeventId field should be used as an idempotency key.
Webhook Retries
If Slash does not receive a2xx response code from your server within 10 seconds, it will retry delivery up to 12 times with exponential backoff.
Endpoint Backoff & Auto-Disable
If webhook deliveries consistently fail, Slash will automatically put your endpoint into abacking-off state to avoid overwhelming your server.
How it works
- Notification retries: Each notification is retried up to 12 times before being marked as permanently failed
- Endpoint backoff: After a notification permanently fails (exhausts all retries), the endpoint enters a backoff period
- Progressive delays: Each consecutive permanent failure increases the backoff duration
- Auto-disable: After 6 consecutive permanent failures with no successful deliveries, the endpoint is automatically disabled
- Reset on success: Any successful delivery immediately resets the backoff cycle to zero
- While in
backing-offordisabledstatus, new events are queued (not lost) - When you re-enable the endpoint, all queued events will be delivered
- You can re-enable an endpoint at any time via the Update webhook endpoint by setting
status: "active" - A successful delivery will reset the backoff cycle
Webhook Signing
Every webhook we send includes aslash-webhook-signature header. Verify that header against the raw request body using our public RSA keys, published here.
We are rotating the signing key. Deliveries use the current key through October 4, 2026, and the new key starting October 5, 2026. During the transition, treat a delivery as authentic when the signature verifies with either key. Verify the exact bytes you received. A parsed and re-serialized body will not match.