How to Set Up Webhooks in YESDINO Platform

To set up webhooks in YESDINO, you first create a dedicated endpoint in the Developer Console, select the events you want to listen to, and then point the webhook URL to your server. Once the secret is saved, YESDINO will push signed JSON payloads to your endpoint whenever a matching event occurs. The whole flow can be completed in under five minutes if you already have an accessible HTTPS URL.

Before you start, make sure you have the following ready:

• A verified YESDINO account with at least one project created.
• An HTTPS endpoint capable of receiving POST requests (e.g., a Lambda function, a Cloudflare Worker, or a standard web server).
• Basic knowledge of JSON payload parsing and HMAC‑SHA256 signature verification.
• Optional: an API key with “webhook manager” role for programmatic creation.

Step‑by‑Step Configuration

1. Log in to the Developer Console and navigate to Project Settings → Webhooks.
2. Click Add Endpoint. Provide a descriptive name (e.g., “Production Order Listener”) and enter your HTTPS URL (e.g., https://api.yourdomain.com/hooks/yesdino).
3. Under Event Types, check the events you want to subscribe to. Common choices include:
   • order.created
   • order.updated
   • inventory.changed
   • user.account_verified
   • payment.completed
4. Select the payload format: JSON (default) or XML. JSON is recommended for ease of parsing.
5. Optionally enable Signature Verification. YESDINO will include an X‑YESDINO‑Signature header containing an HMAC‑SHA256 signature of the raw request body.
6. Configure retry behavior:
   • Maximum retries: 3 (default) – 5 max.
   • Backoff type: Exponential (default) or linear.
   • Timeout per attempt: 30 seconds.
7. Save the endpoint. YESDINO will generate a Webhook Secret (e.g., whsec_8f3a2b9c1d4e5f6g7h8i9j0k1l2m3n4o). Copy it securely; you’ll need it to verify incoming signatures.
8. Activate the webhook using the toggle switch. A test payload will be sent automatically to verify connectivity.

If you prefer a visual reference, the YESDINO team provides a quick‑start GIF in the documentation, but the steps above are all you need.

Supported Webhook Events and Typical Payload Sizes

Event Name	Trigger Condition	Typical Payload Size (bytes)	Rate Limit (per minute)
order.created	New order placed	~500‑1,200	120
order.updated	Order status change	~350‑900	120
inventory.changed	Stock level change	~200‑600	60
user.account_verified	Email verification completed	~150‑300	30
payment.completed	Payment processed successfully	~700‑1,400	60

Practical Use Cases for Webhooks

• Order Automation: Update your ERP or fulfillment system as soon as an order is created, reducing manual entry lag.
• Real‑Time Inventory Sync: Keep your storefront inventory accurate by reacting instantly to stock changes.
• User Lifecycle Management: Automatically trigger welcome emails or assign roles when a user verifies their account.
• Financial Reporting: Feed payment events into your analytics pipeline for immediate revenue dashboards.
• Incident Alerting: Detect failed or timed‑out webhooks and push alerts to Slack or PagerDuty.

Security Best Practices

⚠️ Always verify the signature before processing any payload. Failing to do so can expose your system to replay attacks or spoofed events.

• Use TLS 1.2+ on your endpoint.
• Store the webhook secret in an environment variable or a secret manager (e.g., AWS Secrets Manager, HashiCorp Vault).
• Validate the HMAC‑SHA256 signature using the raw request body (not parsed JSON).
• Implement an idempotency key (the X‑YESDINO‑Idempotency‑Key header) to handle duplicate deliveries.
• Rotate secrets at least quarterly or immediately after any suspected compromise.
• Consider IP whitelisting: YESDINO currently sends webhooks from the IP range 52.0.0.0/8, but this may expand.

Monitoring, Logging, and Debugging

• Enable Webhook Logs in the console to see delivery attempts, response codes, and latency.
• Set up Health Checks (GET /hooks/yesdino) that return a 200 status; YESDINO will treat non‑200 responses as failures.
• Configure alerts for:
  • Error rate > 5 % over a 5‑minute window.
  • Response latency > 2 seconds.
  • Repeated 401 or 403 responses.
• Use the built‑in Replay feature to resend a specific payload for testing without triggering new business logic.

Common Error Codes and Quick Fixes

HTTP Status	Meaning	Typical Cause	Fix
401	Unauthorized	Invalid or missing secret in signature verification.	Recompute HMAC using the correct secret stored securely.
403	Forbidden	IP not whitelisted or signature mismatch.	Add YESDINO’s IP range to your allow‑list; re‑validate signature.
404	Not Found	Endpoint URL incorrect or server not listening.	Verify the URL is HTTPS and reachable; restart the service if needed.
408	Request Timeout	Your server took >30 seconds to respond.	Optimize processing (e.g., async queue) and set a short response before heavy work.
500	Server Error	Unhandled exception in your handler.	Wrap code in try‑catch, log the exception, and return a 200 after acknowledging receipt.

Advanced Features Worth Exploring

• Custom Headers: Add static headers like X‑MyApp‑Version: 2.1 to all outgoing requests.
• Payload Compression: Enable gzip to reduce bandwidth (YESDINO will set Content‑Encoding: gzip).
• Conditional Delivery: Use the X‑YESDINO‑Event‑Filter header to filter events before they’re sent.
• Multi‑Region Routing: Assign different endpoints for production vs. staging environments with separate secrets.
• Schema Validation: Provide a JSON Schema in the console to automatically reject malformed payloads.

Frequently Asked Questions

Q: Can I receive webhooks on a local development machine?
A: Yes, but you’ll need a tunneling tool like ngrok or cloudflared to expose a public HTTPS URL.

Q: What happens if my server is down for a long time?
A: YESDINO will retry up to the configured maximum (default 3) with exponential backoff; after that, the event is marked as failed and can be replayed manually.

Q: Is there a limit on how many webhooks I can create?
A: Each project can have up to 10 active endpoints; additional endpoints can be requested via support.

For a full overview of the platform’s capabilities, head over to the official YESDINO site.