Everything comes back to you

{
  "url": "https://example.com/hooks/wavesenda",
  "events": ["message.received", "message.failed", "session.logged_out"],
  "session": null,
  "headers": { "X-Gateway-Token": "..." },
  "max_retries": 5,
  "timeout_seconds": 10
}

import express from 'express'
import { verifyWebhook } from '@kunshort/wavesenda'

const app = express()

// The raw body is required — re-serialising JSON changes the bytes and the
// signature will never match.
app.post('/hooks/wavesenda', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verifyWebhook(
    req.body,
    req.header('X-WaveSenda-Signature'),
    process.env.WAVESENDA_WEBHOOK_SECRET,
  )
  if (!ok) return res.sendStatus(400)

  // Acknowledge first; do the work off the request.
  res.sendStatus(200)

  const event = JSON.parse(req.body.toString())
  queue.add(event)
})

from flask import Flask, request, abort
from wavesenda import verify_webhook

app = Flask(__name__)

@app.post("/hooks/wavesenda")
def hook():
    if not verify_webhook(
        request.get_data(),
        request.headers.get("X-WaveSenda-Signature"),
        os.environ["WAVESENDA_WEBHOOK_SECRET"],
    ):
        abort(400)

    queue.enqueue(request.get_json())
    return "", 200

{
  "event": "message.received",
  "created_at": "2026-09-09T08:51:50.527600Z",
  "data": {
    "id": "0f8c2b1e-...",
    "wa_message_id": "wamid.HBgM...",
    "session": { "id": "8f14e45f-...", "name": "support" },
    "conversation": "b41d0c2e-...",
    "direction": "inbound",
    "type": "text",
    "from": "+237670000000",
    "text": "Is the blue one still in stock?",
    "timestamp": "2026-09-09T08:51:49Z"
  }
}

attempt 1 → +10s
attempt 2 → +1m
attempt 3 → +5m
attempt 4 → +30m
attempt 5 → +2h    then exhausted