Kustomcode Logo
Kustomcode Logo
Kustomcode Relay v1.0Production REST Spec

Developer Documentation & API Reference

Complete technical specification for high-throughput zero-block webhook ingestion, HMAC validation, and programmatic Dead-Letter Queue replay.

Architecture Specification

1. Overview & Ingress Resilience

Kustomcode Relay acts as an ultra-low latency, zero-block webhook reverse proxy. Designed for high-volume Stripe, Shopify, and e-commerce webhooks, it buffers incoming byte payloads directly into a private BullMQ/Redis pipeline and returns an immediate 202 Accepted acknowledgement in sub-3ms.

⚡ < 3ms
Average ingress acknowledgement latency
Full Jitter
Randomized exponential backoff retries
Immutable DLQ
Complete raw body & header audit trail

2. Ingestion Protocol

Replace your webhook destination endpoint in your Stripe or Shopify dashboard with your Kustomcode Ingress URL:

POST https://relay-production-54ca.up.railway.app/v1/in/:endpointId
Ingress Request Example
curl -X POST https://relay-production-54ca.up.railway.app/v1/in/ep_live_99f2b8a7c1 \
  -H "Content-Type: application/json" \
  -H "X-Client-Signature: 8f2c6e147b..." \
  -d '{
    "event": "checkout.session.completed",
    "amount": 4900,
    "currency": "usd",
    "customer": "vip@acme-enterprise.com"
  }'

Expected Response (`202 Accepted`)

{ "status": "ACCEPTED", "deliveryId": "del_89f02b11a", "endpointId": "ep_live_99f2b8a7c1", "receivedAt": "2026-08-30T15:24:10.119Z" }

3. Downstream Forwarding & Headers

When Relay delivers the buffered payload to your downstream target URL, all original sender headers are preserved intact. Relay also attaches metadata headers to facilitate idempotency and tracing:

HeaderExample ValueDescription
X-Relay-Delivery-Iddel_89f02b11aUnique immutable ID for idempotency key indexing
X-Relay-Attempt1Current retry delivery attempt number (1 through 10)
X-Relay-Timestamp1756560250119Original millisecond timestamp when the payload hit the proxy

4. HMAC Signature Verification Guide

Verify authentic webhooks on your downstream server using timing-safe cryptographic comparisons.

Shopify Signature Verification (`X-Shopify-Hmac-Sha256`)

Shopify calculates a Base64-encoded HMAC-SHA256 signature using your store's Webhook Shared Secret.

Shopify HMAC Verification
import crypto from 'crypto';

export function verifyShopifyWebhook(
  rawBody: string | Buffer,
  shopifyHeader: string,
  secret: string
): boolean {
  const hash = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('base64');

  // Use timingSafeEqual to protect against timing attacks
  const calculatedBuf = Buffer.from(hash, 'utf8');
  const receivedBuf = Buffer.from(shopifyHeader, 'utf8');

  if (calculatedBuf.length !== receivedBuf.length) {
    return false;
  }
  return crypto.timingSafeEqual(calculatedBuf, receivedBuf);
}

Stripe Signature Verification (`Stripe-Signature`)

Stripe sends a Unix timestamp and hex-encoded HMAC-SHA256 signature to protect against replay attacks.

Stripe Signature Verification
import crypto from 'crypto';

export function verifyStripeWebhook(
  rawBody: string,
  stripeSignatureHeader: string,
  secret: string,
  toleranceSeconds = 300
): boolean {
  // Header format: t=1756560000,v1=9e8bf69e7...
  const items = stripeSignatureHeader.split(',');
  const timestamp = items.find((i) => i.startsWith('t='))?.slice(2);
  const signature = items.find((i) => i.startsWith('v1='))?.slice(3);

  if (!timestamp || !signature) return false;

  // Prevent replay attacks
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp, 10)) > toleranceSeconds) {
    return false;
  }

  const payloadToSign = `${timestamp}.${rawBody}`;
  const computedHash = crypto
    .createHmac('sha256', secret)
    .update(payloadToSign, 'utf8')
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(computedHash, 'hex'),
    Buffer.from(signature, 'hex')
  );
}

5. Programmatic Dead-Letter Queue (DLQ) API

Audit, inspect, and replay failed webhooks programmatically using the Kustomcode Relay REST API.

List DLQ Events
GET /api/v1/relay/dlq?status=DEAD&limit=50

Returns failed webhook payloads with full error traces and attempt histories.

Replay Event
POST /v1/events/:eventId/replay

Pushes the dead event back into the BullMQ active queue for immediate dispatch.

DLQ Replay Code Snippet
# Replay a single failed dead-letter webhook event
curl -X POST https://relay-production-54ca.up.railway.app/v1/events/evt_dead_9921b7/replay \
  -H "Authorization: Bearer kustom_sec_live_9941a8" \
  -H "Content-Type: application/json"

# Response:
# {"replayed": true, "eventId": "evt_dead_9921b7", "status": "PENDING"}
Unauthenticated Sandbox

6. Interactive Ingress Sandbox

Fire test payloads and watch the sub-3ms ingestion handshake and delivery lifecycle live:

Interactive Ingress GatewayProduction API

Dispatch webhook events to benchmark zero-block 202 ingress & cryptographic audit capture

Ingress Payload (JSON)POST /api/relay/ingress/live-test
Headers: 4 included
Ingress Log Stream
0 logged

Ready for Ingestion

Click Dispatch Webhook to trigger live pipeline

BullMQ Queue ActiveSLA: < 3.0ms