What a reliable webhook handler needs
- No cold start. The slot is always running, so the first request after a quiet hour is as fast as the hundredth.
- The raw body. Signature checks hash the exact bytes the provider sent. Your handler receives the raw request, see webhook signatures and the raw body.
- Secrets that stay secret. Signing secrets live in environment variables. Your agent can set them; scoped tokens can be denied read access.
- A place to put events. Write to the durable
/persistdisk or the key-value store and process later in the same slot, with no run-time limit. - An answer to "did it arrive?". Live logs and request traces show every call. Your coding agent can query them over MCP, see a webhook your agent can query.
Public by default where it should be
DenkOps projects are protected by default. Mark only the webhook path as public in denkops.json and everything else stays behind authentication, see auth by default, public paths.
Pick your framework
Each guide below is a complete handler with signature verification, ready to deploy.