--- title: Webhook Architecture Design | daily.dev description: Svix founder Tom Hacohen and Head of Growth Ken Ruf discuss best practices for designing webhook infrastructure at scale, walking through a reference... canonical: https://daily.dev/posts/webhook-architecture-design-qmu60xogp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Webhook Architecture Design | daily.dev og:description: Svix founder Tom Hacohen and Head of Growth Ken Ruf discuss best practices for designing webhook infrastructure at scale, walking through a reference... og:url: https://daily.dev/posts/webhook-architecture-design-qmu60xogp og:image: https://api.daily.dev/og/posts/qmU60XOgp.png og:image:alt: Webhook Architecture Design og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Webhook Architecture Design **[Svix Blog](https://daily.dev/sources/svix)** · 23 min read · 0 upvotes · 0 comments ## Summary Svix founder Tom Hacohen and Head of Growth Ken Ruf discuss best practices for designing webhook infrastructure at scale, walking through a reference architecture diagram. Topics include using an API service with a load balancer and WAF, persisting messages before queuing them, background workers with exponential backoff retries, caching with Redis, and extensive logging/monitoring since webhook failures are invisible to senders. They also cover security practices: isolating webhook systems in their own VPC and database, signing requests with HMAC-SHA256 with per-endpoint keys, verifying timestamps to prevent replay attacks, guarding against SSRF via DNS-filtering proxies and network isolation, and sending from static IP ranges for enterprise firewall allowlisting. Feature-level recommendations include event type filtering, rate limiting to protect downstream customer systems, respecting 429 responses, and giving customers delivery visibility. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How should I prevent server-side request forgery (SSRF) attacks in a webhook delivery system? Protect against SSRF by routing outbound webhook requests through a proxy that filters DNS resolutions and blocks internal IP ranges or subnets, and by placing the webhook dispatch service in a separate VPC with no inbound access back to the main network. This prevents attackers from pointing webhook URLs at internal services like an HR system for reconnaissance or data exfiltration. _daily.dev surfaces practical writeups like this for engineers hardening webhook infrastructure against SSRF._ ### Why shouldn't a webhook service make HTTP calls directly from the API request handler? Making the HTTP call directly ties up API resources whenever a customer endpoint is slow, times out, or fails, risking exhaustion of the API server's capacity. The recommended approach is to persist the webhook, place it on a queue, and let background workers handle delivery and retries so the API endpoint stays responsive even under load. _Developers designing reliable async delivery pipelines can find architecture breakdowns like this on daily.dev._ ### What retry schedule should a webhook system use for failed deliveries? An exponentially increasing retry schedule works well: an immediate retry, then after five seconds, five minutes, thirty minutes, and so on, continuing for up to two days before giving up, though the exact windows can be tuned. This gives a struggling customer endpoint, such as one with a few hours of downtime, enough time to recover before the webhook is marked as permanently failed. _daily.dev helps engineers compare retry and reliability patterns before committing to a webhook design._ ## Similar posts on daily.dev - [Your Webhook Endpoint Is a Tiny Distributed System](https://daily.dev/posts/your-webhook-endpoint-is-a-tiny-distributed-system-izgpxyxum) · Ruby Flow · 0 upvotes · 0 comments - [The valley of webhooks](https://daily.dev/posts/the-valley-of-webhooks-6ekxclvor) · Hacker News · 0 upvotes · 0 comments - [Realtime AI Agent - A Deep Dive](https://daily.dev/posts/realtime-ai-agent---a-deep-dive-q4v3vciti) · System Design Newsletter · 0 upvotes · 0 comments - [Inside the Events Rail: How Atlassian Delivers 10 Billion Webhooks a Month](https://daily.dev/posts/inside-the-events-rail-how-atlassian-delivers-10-billion-webhooks-a-month-28sbia0pb) · Atlassian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#career](https://daily.dev/tags/career), [#redis](https://daily.dev/tags/redis) [View this post on daily.dev](https://daily.dev/posts/webhook-architecture-design-qmu60xogp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Webhook Architecture Design","url":"https://daily.dev/posts/webhook-architecture-design-qmu60xogp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/webhook-architecture-design-qmu60xogp"},"datePublished":"2026-08-23T07:20:25.050Z","dateModified":"2026-08-23T07:25:19.769Z","description":"Svix founder Tom Hacohen and Head of Growth Ken Ruf discuss best practices for designing webhook infrastructure at scale, walking through a reference...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c56d7a334656d23e3f178f5103b38020?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c56d7a334656d23e3f178f5103b38020?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Svix Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Svix Blog","logo":"https://media.daily.dev/image/upload/s--Shf9MlOr--/f_auto,q_auto/v1787469609/logos/svix?_a=BAMAMicg0","url":"https://daily.dev/sources/svix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/webhook-architecture-design-qmu60xogp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,career,redis","timeRequired":"PT23M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Svix Blog","item":"https://daily.dev/sources/svix"},{"@type":"ListItem","position":3,"name":"Webhook Architecture Design"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/webhook-architecture-design-qmu60xogp#faq","mainEntity":[{"@type":"Question","name":"How should I prevent server-side request forgery (SSRF) attacks in a webhook delivery system?","acceptedAnswer":{"@type":"Answer","text":"Protect against SSRF by routing outbound webhook requests through a proxy that filters DNS resolutions and blocks internal IP ranges or subnets, and by placing the webhook dispatch service in a separate VPC with no inbound access back to the main network. This prevents attackers from pointing webhook URLs at internal services like an HR system for reconnaissance or data exfiltration. daily.dev surfaces practical writeups like this for engineers hardening webhook infrastructure against SSRF."}},{"@type":"Question","name":"Why shouldn't a webhook service make HTTP calls directly from the API request handler?","acceptedAnswer":{"@type":"Answer","text":"Making the HTTP call directly ties up API resources whenever a customer endpoint is slow, times out, or fails, risking exhaustion of the API server's capacity. The recommended approach is to persist the webhook, place it on a queue, and let background workers handle delivery and retries so the API endpoint stays responsive even under load. Developers designing reliable async delivery pipelines can find architecture breakdowns like this on daily.dev."}},{"@type":"Question","name":"What retry schedule should a webhook system use for failed deliveries?","acceptedAnswer":{"@type":"Answer","text":"An exponentially increasing retry schedule works well: an immediate retry, then after five seconds, five minutes, thirty minutes, and so on, continuing for up to two days before giving up, though the exact windows can be tuned. This gives a struggling customer endpoint, such as one with a few hours of downtime, enough time to recover before the webhook is marked as permanently failed. daily.dev helps engineers compare retry and reliability patterns before committing to a webhook design."}}]} ```