Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.vibefollow.com/llms.txt

Use this file to discover all available pages before exploring further.

Outbound webhook delivery is in active build. Signature verification on the SDK side is fully shipped and tested — this page describes the contract the backend will emit against. Target shipping date: Phase Dev2, end of June 2026. Subscribe to the changelog for the GA notice.
Vibefollow can push events back to your backend over HTTPS — one delivery per email open, click, bounce, reply, and unsubscribe. You receive them at an endpoint you control, verify the signature, and react however you like (update your CRM, kick off a workflow, alert on negative replies).

​
Lifecycle of a delivery

1

A receivable event happens

Postmark reports an open back to Vibefollow, an inbound reply comes through, or a user clicks the one-click unsubscribe link.
2

Vibefollow signs the payload

Body bytes are HMAC-SHA256’d with your project’s webhook secret; the timestamp goes in the header.
3

POST to your endpoint

Content-Type: application/json, X-Vibefollow-Signature: t=…,v1=….
4

You verify and respond

Return 2xx within 10 seconds and the delivery is marked complete.
5

On non-2xx or timeout

Vibefollow retries with exponential backoff — up to 8 attempts over ~24 hours. After that the delivery is dead-lettered and visible in the dashboard.

​
Setting up an endpoint

1

Expose an HTTPS endpoint

Accept POST with JSON bodies. Make sure your framework can hand you the raw request body, not a parsed object.
2

Register the URL

In Settings → Developers → Webhooks (coming soon), add the URL and generate a signing secret. Store the secret as VIBEFOLLOW_WEBHOOK_SECRET.
3

Verify every delivery

Use the SDK — see Signature verification.
4

Subscribe to event types

Switch on the event types you care about.

​
Retry policy

Failed deliveries (non-2xx, timeout, connection error) retry with exponential backoff and jitter. The schedule, all in real time:
AttemptDelay since previous
1initial
230 seconds
32 minutes
410 minutes
530 minutes
62 hours
76 hours
812 hours
After 8 attempts the delivery is dead-lettered. You can replay it manually from the in-dashboard deliveries log.

​
Why the raw body

The signature is computed over the exact bytes the server sent. If you parse the body first and re-serialise — key ordering, whitespace, escaped slashes — verification will fail. Use your framework’s raw-body mechanism (express.raw(), Hono request.text(), etc.) before the SDK touches it.

​
What events you can receive

email.opened

Recipient opened a tracked email.

email.clicked

Recipient clicked a link in a tracked email.

email.bounced

Postmark reported a bounce or spam complaint.

email.replied

Inbound reply parsed and tone-classified.

email.unsubscribed

One-click unsubscribe, reply-request, or manual.

Event types reference

Full payload spec for each event type.