Reference

Webhooks

Kestrel sends an HTTPS POST to your endpoint whenever something changes.

Events

• booking.created
• booking.cancelled
• calendar.updated

Verify the signature

Every request has a Kestrel-Signature header. Compute an HMAC-SHA256 of the raw body with your webhook secret and compare in constant time.

import crypto from 'node:crypto';

export function verify(rawBody, header, secret) {
  const expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(header));
}

Retries

If your endpoint does not return a 2xx within 10 seconds we retry up to 8 times with exponential back-off over 24 hours.