Download the PHP package arraypress/wp-webhooks without Composer
On this page you can find all versions of the php package arraypress/wp-webhooks. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download arraypress/wp-webhooks
More information about arraypress/wp-webhooks
Files in arraypress/wp-webhooks
Package wp-webhooks
Short Description Signed webhooks: Stripe-compatible signatures, replay protection and a status-aware retry policy.
License GPL-2.0-or-later
Homepage https://github.com/arraypress/wp-webhooks/
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package wp-webhooks
WordPress Webhooks
Send webhooks that receivers can verify, and retry the ones worth retrying.
What it does
A webhook that anyone can forge is not a webhook. The signature has to cover a timestamp as well as the body, or an attacker can capture one request and replay it forever.
This uses Stripe's scheme, so receivers already know how to check it and can
often reuse code they have. It signs timestamp.payload, sends both in the
header, and rejects anything outside a tolerance window on the way back in.
The other half is delivery. Not every failure is worth retrying — a 404 or a 422 will fail identically next time — so the retry policy distinguishes them and backs off on the ones that might recover.
Features
- Stripe-compatible signatures, so receivers can verify with familiar code
- Timestamp inside the signed payload, so a captured request cannot be replayed
- Constant-time comparison, so signatures cannot be brute-forced by timing
- Supports several active secrets at once, for zero-downtime key rotation
- Retries only what might succeed — no retry on a 4xx that will never change
- Exponential backoff that honours a
Retry-Afterheader when one is sent - Explains why verification failed, without leaking that to the sender
Installation
Quick start
Requirements
- PHP 8.3 or later
- WordPress 7.1 or later
License
GPL-2.0-or-later
