@10x-media/webhooks

Outbound webhook subscriptions for Payload v3. Opt collections in, let subscribers register URLs in the admin panel (or in code), and deliver signed HTTP POSTs on every create, update, and delete, inline or through Payload's jobs queue, with retries and an append-only delivery log.

Part of the @10x-media Payload plugins collection. In beta: published under the beta dist-tag until a stable 1.0.

Features

• Opt-in collections with per-collection operations, previousData on updates, and a transform to reshape or redact payloads.
• Two subscription sources: admin-managed records and hard-coded code subscriptions, merged at delivery time.
• Delivery modes: queued through Payload jobs (retries, timeouts) or inline; auto detects whether a runner exists.
• Standard Webhooks signing: HMAC-SHA256 over ${id}.${timestamp}.${body}, base64, under webhook-signature, so receivers verify with an off-the-shelf library.
• Write-only secrets, AES-256-GCM encrypted at rest via @10x-media/fields, shown once and stripped from every read.
• Secret rotation with a grace period that signs with both secrets until receivers have switched over.
• Delivery log with status, response code, duration, the exact body sent, and one-click redelivery.
• Jobs family interop: installing @10x-media/jobs switches delivery to the queue automatically.
• Typed translations with per-key overrides via @10x-media/webhooks/i18n.

Quick start

pnpm add @10x-media/webhooks @10x-media/fields

@10x-media/fields is a peer dependency: signing secrets are stored through its encrypted field, whose admin components resolve through your import map. You do not have to register the fields() plugin.

// payload.config.ts
import { buildConfig } from 'payload'
import { webhooks } from '@10x-media/webhooks'

export default buildConfig({
  plugins: [
    webhooks({
      collections: {
        posts: true,
        orders: { operations: ['create', 'delete'] },
      },
    }),
  ],
})

Then create a subscription in the admin (Webhooks group), copy its signing secret to your receiver before saving, and write to an opted-in collection.

Documentation

Full documentation at docs.10xmedia.de:

• Overview
• Quick start
• Subscriptions
• Deliveries
• Signing and secrets
• Security model
• i18n

License

MIT. Copyright 10x Media GmbH.