At least once over false exactly once
A stable webhook ID gives receivers an idempotency key while lease recovery accepts that duplicate network delivery can occur.
Distributed systems · Webhook delivery
Relay
2026 / v1.0A production webhook delivery platform that turns retries, receiver failures, signatures, and recovery into a durable lifecycle operators can inspect instead of infer.
01
The reliability problem
Sending one HTTP request is easy. Preserving delivery intent through timeouts, rate limits, process interruption, secret rotation, and incident review is a distributed-systems problem.
Relay was designed so an accepted event always has durable work behind it, retries remain bounded and explainable, receivers can deduplicate requests, and operators have enough evidence to understand every outcome.
02
Architecture
D1 is the durable source of truth. The Queue transports ready delivery identifiers, while a scheduled Worker republishes due outbox work, recovers expired leases, and applies bounded retention.
IngressAuthenticated event
DurabilityD1 transactionEvent · fanout · outbox
TransportCloudflare QueueLease · classify · reschedule
DestinationSigned receiverStable webhook identity
03
Operational evidence
04
Important engineering decisions
Transactional outbox over dual writes
Event acceptance, endpoint fanout, and publication intent commit together so accepted work cannot disappear between the database and queue.
D1 scheduling plus Queue transport
D1 owns due time, retry policy, and recovery. Queue messages remain compact wake-ups for work that is ready now.
Evidence as product behavior
Every delivery attempt records bounded, redacted evidence, making retries, replay lineage, and terminal outcomes inspectable from the console.
Controlled public failure injection
Failure Lab exposes seven fixed receiver behaviors behind Turnstile and quotas without accepting arbitrary URLs or payloads.
Free-only production topology
Two Workers, D1, Queues, Cron, Turnstile, and a Service Binding demonstrate the system without paid infrastructure or hidden trial dependencies.
05 / Public demonstration
Break the receiver. Watch Relay recover.
06
Quality and production proof
The release combines application tests, database-backed Worker tests, browser journeys, responsive and accessibility coverage, publishing safety, cost guardrails, and a controlled production retry run.
- 283
- application and shared-contract tests
- 12
- browser, accessibility, and responsive journeys
- 9
- publishing, production-config, and provisioning checks
In production, the flaky receiver returned HTTP 500 twice and HTTP 200 on the third attempt. Relay preserved one webhook identity, generated fresh signatures, and recorded each receiver receipt.
07
Result
Relay demonstrates production reasoning beyond CRUD: transactional boundaries, concurrency control, cryptographic handling, failure classification, cost-aware operations, and evidence-backed delivery.