> ## Documentation Index
> Fetch the complete documentation index at: https://docs.medera.info/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhooks Overview

> How Medera webhooks work

Webhooks are delivered to a tenant-configured URL with signed headers.

| Header                | Description                                                     |                                                                                                                                                                       |        |              |
| :-------------------- | :-------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | ------------ |
| `Medera-Signature`    | `sha256=<hmac>` of the body using the per-tenant webhook secret |                                                                                                                                                                       |        |              |
| `Medera-Event`        | Event name                                                      |                                                                                                                                                                       |        |              |
| `Medera-Delivery-Id`  | Unique delivery ID — use for idempotency                        |                                                                                                                                                                       |        |              |
| `Medera-Timestamp`    | Delivery timestamp (verify within ±5 minutes)                   | Inbound webhooks from external services (Medera Voice, payment processor, the identity provider, payer systems) are verified separately with the source's own scheme: | Source | Verification |
| :---                  | :---                                                            |                                                                                                                                                                       |        |              |
| Medera Voice          | HMAC-SHA256 (`medera-voice-signature`) via                      |                                                                                                                                                                       |        |              |
| payment processor     | `payment processor-Signature`                                   |                                                                                                                                                                       |        |              |
| the identity provider | HMAC (`svix-id`, `svix-timestamp`, `svix-signature`)            |                                                                                                                                                                       |        |              |
| Payer                 | Per-payer HMAC secret                                           |                                                                                                                                                                       |        |              |

## Retry

Failed deliveries retry with exponential backoff for 24 hours, then move to a dead-letter queue.