> For the complete documentation index, see [llms.txt](https://islamu.gitbook.io/islamu-event/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://islamu.gitbook.io/islamu-event/documentation/readme/integrations-and-ai/webhooks.md).

# Webhooks

Operate incoming callbacks and outgoing product webhooks as separate trust boundaries.

Incoming provider callbacks and outgoing product webhooks represent completely separate trust boundaries in ISLAMU Event. They use different authentication, replay windows, delivery engines, and recovery runbooks.

***

## 1. Outgoing Delivery Modes

Configured via `WEBHOOKS_PROVIDER` in [Environment Variables](/islamu-event/documentation/readme/configuration-and-operations/environment-variables.md#11-advanced-outgoing-webhooks-svix-infrastructure):

| Mode        | Engine / Architecture                                                    | Best Fit                                                   |
| ----------- | ------------------------------------------------------------------------ | ---------------------------------------------------------- |
| `Disabled`  | Outgoing webhooks disabled entirely.                                     | Small local deployments with no external subscribers.      |
| `Local`     | Built-in in-process dispatcher signing Svix-compatible HMAC envelopes.   | Single-container Standalone or lightweight Compose setups. |
| `Svix`      | Self-hosted [Svix v1.96.1](https://svix.com) with PostgreSQL and Redis.  | High-throughput multi-tenant production clusters.          |
| `Composite` | Explicit routing between Local and Svix per event type.                  | Hybrid enterprise migrations.                              |
| `DryRun`    | Validates payloads and records outbox work without contacting endpoints. | Staging and test verification.                             |

> \[!NOTE] To run self-hosted Svix, start Compose with the `webhooks` profile: `docker compose --profile webhooks up -d` (see [Docker Compose Profiles](/islamu-event/documentation/readme/self-hosting/docker-compose.md#optional-service-profiles)).

***

## 2. Local Dispatcher Security & SSRF Protection

When running in `Local` mode:

* Signs outgoing payloads using standard HMAC-SHA-256 signatures (`webhook-signature` headers).
* Applies an eight-step exponential retry policy with jitter.
* Enforces strict Server-Side Request Forgery (SSRF) protections: private IP ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`), loopback (`127.0.0.1`), link-local (`169.254.0.0/16`), and cloud metadata endpoints (`169.254.169.254`) are blocked by default.

***

## 3. Incoming Provider Callbacks

Incoming routes include:

* **Payment Webhooks**: Stripe Connect payment intents and refund receipts (see [Paid Events & Payouts](/islamu-event/documentation/readme/events-and-ticketing/paid-events-and-payouts.md)).
* **Moderation Webhooks**: Signal evaluation callbacks from [Coop & Osprey](/islamu-event/documentation/readme/integrations-and-ai/coop-and-osprey.md).
* **Operational Intake**: Svix endpoint status events.

Every incoming callback verifies HMAC signatures, evaluates idempotency keys, and records intake to the database before executing any business transitions.

***

## Related Guides & Next Steps

* [**Docker Compose Runbook**](/islamu-event/documentation/readme/self-hosting/docker-compose.md#optional-service-profiles) — Launch the Svix webhook container profile.
* [**Paid Events & Payouts**](/islamu-event/documentation/readme/events-and-ticketing/paid-events-and-payouts.md) — Learn how Stripe webhooks settle ticket sales.
* [**Environment Variables Reference**](/islamu-event/documentation/readme/configuration-and-operations/environment-variables.md#11-advanced-outgoing-webhooks-svix-infrastructure) — Configure Svix Redis, DSN, and JWT signing keys.
* [**Secrets Management**](/islamu-event/documentation/readme/configuration-and-operations/secrets.md) — Safely bind webhook signing secrets.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://islamu.gitbook.io/islamu-event/documentation/readme/integrations-and-ai/webhooks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.