Receive events
Configure an HTTPS endpoint that accepts POST requests. Return a 2xx response within five seconds and process heavier work asynchronously.
Verify signatures
Compute HMAC-SHA256 over the raw request body with your webhook secret and compare it to the Nordic-Signature header using a constant-time comparison.
Header
Nordic-Signature: t=1786406400,v1=4fc7…Delivery attempts
Failed deliveries are retried with exponential backoff. Deduplicate with the event ID and make handlers idempotent.