Subscribed events reduce polling, but require fast response, deduplication, and queuing. See how to operate AI automations reliably.
Direct answer
OpenAI webhooks send POST to a company-controlled endpoint when selected events happen. The receiver must verify the signature with the given secret, respond quickly with status 2xx, and move relevant processing to a queue. Unconfirmed deliveries can be repeated for up to 72 hours with exponential backoff, so every consumer needs to be idempotent and tolerate duplicate events.
Signature authenticates the origin
Check the raw body with the secret on the server before accepting the event; exposed secret must be rotated.
Fast response separates receiving from processing
Confirm receipt and queue up heavy work. Running everything before 2xx increases timeout and repetition.
Duplication is expected behavior
Retries protect against transient failures. Store the event identifier and make each effect idempotent.
Observability closes the loop
Record receipt, verification, deduplication, processing, result and eventual dead queue without exposing sensitive data.
Nexus Reading
Use webhook as a reliable input to a workflow, not as a direct execution of irreversible actions without validation and authorization.
FAQ
Is it mandatory to verify the signature?
Yes, to confirm that the POST was issued by OpenAI and not a third party.
Why respond 2xx quickly?
To confirm receipt before the timeout and avoid unnecessary retries.
Can the same event arrive more than once?
Yes. The consumer must deduplicate and execute effects idempotently.
Essential guides to delve deeper into the decision
This editorial analysis was produced by Nexus from the official sources below, consulted on October 31, 2026. The text is original and interprets practical implications for companies.
- OpenAI Developers — Webhooks: configuration, signature, 2xx response, retries and secret rotation.
- Standard Webhooks — specification: interoperable signature format referenced by official documentation.
Date reported by main source: official documentation consulted on October 31, 2026; technical analysis.