User guide
A practical guide to receiving, forwarding and troubleshooting your webhooks.
Steps and button names match the current client dashboard.
Getting started
Sign up from Start free trial, verify your email, sign in, and open the dashboard. The sidebar contains Overview for usage and billing state, Endpoint health for destination health, Security for signing secrets and activity, Destinations for forwarding targets, Deliveries for event history, Alert settings for notifications, Billing for plans and invoices, and Customization for the customer-facing portal. [screenshot: dashboard sidebar with labels]
- Use the language switcher when you need Arabic or English.
- The first dashboard load shows your webhook endpoint and current plan.
- Keep your signing secret on your server; do not paste it into browser code.
Endpoints and webhooks
Your endpoint is shown in the dashboard as the webhook URL. Use Copy to copy it, send a POST request, and watch the event appear in Deliveries. An active destination receives matching events. Pause or disable a destination when you need a temporary stop; delete only when you no longer need its configuration. [screenshot: endpoint and copy control]
- A successful ingest is accepted before delivery attempts begin.
- Inactive or expired company states can reject ingest before an event is created.
- A status badge describes the current lifecycle or delivery state, not a guarantee that the remote destination is healthy.
Destinations
Open Destinations to add a forwarding URL, choose event filters, set a timeout and maximum attempts, then save. Use Test this destination before relying on production traffic. Edit a destination to change its URL or settings; disable it to stop forwarding without deleting its history. If a destination is down, RawNak records the response or network error, retries eligible failures, and shows the attempts in Deliveries. [screenshot: destination form]
- Use HTTPS for production destinations.
- A failed destination does not delete the received event.
- Fix the remote service, then use Retry delivery for an eligible attempt or Replay event for a new run.
Events and event flow
Deliveries lists received events and their forwarding result. Filter by status, response code, event name, destination and date. Open an event for its payload, response and attempts timeline. The Attempt column is shown as attempt_number / max_attempts, for example 1/3. Retry delivery continues a retryable attempt; Replay event creates a new delivery run. [screenshot: delivery table and inspector]
| Symptom | Cause | Fix |
|---|---|---|
| No event appears | Wrong company segment, rejected lifecycle, invalid request or request never reached RawNak. | Check the URL, HTTP status, request logs and company billing state. |
| Delivery is retrying | The destination returned a retryable status or timed out. | Restore the destination and inspect the next retry time; retry manually only when appropriate. |
| 401 or signature error | Missing or incorrect X-Rawnak-Signature or wrong signing secret. | Sign the exact raw body with the current secret and use the sha256= header format. |
| 429 | A rate or concurrency limit was reached. | Reduce burst traffic, check plan limits, and retry after the indicated period. |
| 500/503 | Remote dependency or server configuration issue. | Inspect the recorded error, correct the dependency, and replay after validation. |
API keys and secrets
RawNak uses a webhook signing secret for inbound verification and a session token for the dashboard. The initial signing secret is shown only through the one-time reveal flow; copy it immediately into your server-side secret manager. Rotate it from Security when it may be exposed. A revoked or rotated secret must no longer be used for new signatures after the change takes effect. [screenshot: security page]
- Never email or commit secrets.
- If you lose the one-time secret, use the supported rotation flow instead of guessing it.
- Dashboard sessions can be invalidated by logging out of all sessions.
Announcements and notifications
Announcements appear in a banner at the top of the client dashboard. They may contain service information or an action requested from you. Read the message in your selected language and dismiss it with the close control; a deactivated announcement disappears after the next refresh. Delivery and billing notifications are controlled from Alert settings when the feature is available for your plan. [screenshot: announcement banner]
Account and security
Change your password from the account security page using the current password and a strong new password. Enable admin two-factor authentication only from the admin security flow when you are the authorized admin. Save each recovery code offline; codes are displayed once and can be regenerated with the required verification. If you lose the device, use a saved recovery code or contact support after proving account ownership. Log out of all sessions after a suspected compromise. [screenshot: security settings]
- Use a unique password of at least 14 characters for admin accounts.
- Do not share recovery codes with support or teammates.
- A new password invalidates existing sessions according to the account security policy.
Plans and billing
The current plans are Free trial ($0 for 7 days), Starter ($19/month), Growth ($49/month), and Enterprise ($99/month). The dashboard Billing page shows the current plan, subscription state, next renewal or trial end, invoices and available upgrade or cancellation actions. Checkout opens only when the account is eligible; a live Stripe subscription must be changed or cancelled through the supported billing flow. When a plan ends, access may become billing-required while stored records remain subject to the configured retention policy. [screenshot: billing page]
- Trial: 1 destination and 1,000 events/month.
- Starter: 3 destinations and 10,000 events/month.
- Growth: 10 destinations and 100,000 events/month, with Growth features.
- Enterprise: 50 destinations and 1,000,000 events/month, with Enterprise features.
- Retention defaults to 90 days and is bounded by the configured workspace policy; confirm the displayed value in Settings.
Limits and quotas
Overview shows monthly event usage and destination usage against the current plan limits. When a quota is reached, the API or dashboard action returns a clear plan or limit error rather than silently discarding data. Reduce traffic, remove unused destinations, wait for the next usage period, or upgrade when the feature is needed. [screenshot: usage cards]
Contact support
Email [email protected]. Include the workspace/company identifier, approximate UTC time, affected endpoint or destination, HTTP status, event ID if available, and a redacted error message. Never send passwords, signing secrets, recovery codes, full authorization headers or card details. [screenshot: support contact]
FAQ
Common customer questions and answers.
- How long is the trial? — Seven days from registration.
- Can I use the same endpoint for every company? — No. Use the company-specific endpoint shown in the dashboard.
- Where do I copy the webhook URL? — Overview shows it with a Copy control.
- Why is my event missing? — Check the URL, request status, lifecycle and filters.
- Why did delivery fail? — Open the event details and inspect response code, body and error message.
- What does 1/3 mean? — It is the current attempt number out of the destination maximum.
- What is Retry delivery? — It retries an eligible delivery attempt.
- What is Replay event? — It creates a new delivery run for the event.
- Will a failed delivery delete my event? — No, the event record remains for inspection.
- How do I test a destination? — Open Destinations and use Test this destination.
- Can I pause a destination? — Yes, disable it without deleting its history.
- Why did I receive 429? — A plan rate or concurrency limit was reached.
- Why do I see 402? — The company lifecycle or billing state requires an allowed billing action.
- Where are announcements? — At the top of the dashboard across tabs.
- Can I dismiss an announcement? — Yes, use its close control; it will reappear only if the product sends it again.
- Where are invoices? — Billing contains the available invoice and portal links.
- What happens after cancellation? — Access follows the subscription lifecycle while stored data remains governed by retention.
- Can I rotate a signing secret? — Yes, use Security and update your sender before sending new traffic.
- What if I lose my recovery codes? — Use the authorized regenerate flow or contact support after account verification.
- What should I send support? — Workspace, time, event ID, status and redacted diagnostics; never secrets or payment details.