Webhook delivery for your API, signed, retried and logged.

Your backend makes one API call per event. VelosCore signs it, delivers it to every customer endpoint that subscribes, retries failures for 27 hours and keeps a log your support team and your customers can search.

Start free Read the API overview

Developer plan: 25,000 events a month, no card required.

~/billing-service

$ npm install @veloscore/node
added 1 package in 1.2s
$ npx veloscore send invoice.paid --app app_2Hq81
msg_2nX9fK queued, 2 endpoints subscribed
ep_acme-erp      503 Service Unavailable  412ms
ep_ledger-sync   200 OK                    88ms
retry 1 in 5s → ep_acme-erp
ep_acme-erp      200 OK                   131ms

Illustrative product interface

Quickstart

Most teams send their first production webhook the same afternoon they sign up.

01
Create an API key
Test and live keys are separate, so staging traffic never reaches customer endpoints.
02
Add customer endpoints
Register URLs through the API, or let customers add their own in the embedded portal.
03
Send events
Call the messages endpoint wherever your code already emits an event. Delivery is asynchronous.

curl

curl -X POST https://api.veloscore.online/v1/app/app_2Hq81/msg \
  -H "Authorization: Bearer $VELOSCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "eventType": "invoice.paid",
    "eventId": "evt_inv_88213",
    "payload": { "invoiceId": "in_88213", "amount": 129000, "currency": "USD" }
  }'

send_event.py

import os
from veloscore import VelosCore

vc = VelosCore(api_key=os.environ["VELOSCORE_API_KEY"])

vc.messages.create(
    app_id="app_2Hq81",
    event_type="shipment.delivered",
    event_id="evt_shp_40177",
    payload={"shipmentId": "shp_40177", "carrier": "UPS"},
)

sendEvent.ts

import { VelosCore } from "@veloscore/node";

const vc = new VelosCore(process.env.VELOSCORE_API_KEY);

await vc.messages.create("app_2Hq81", {
  eventType: "employee.onboarded",
  eventId: "evt_emp_5521",
  payload: { employeeId: "emp_5521", startDate: "2026-11-02" },
});

API reference at a glance

A REST API over HTTPS with JSON bodies and bearer-token auth. SDKs for Node.js, Python, Go, Ruby and PHP wrap the same endpoints.

Applications

POST /v1/app

Create one application per customer account so events and endpoints stay isolated.
GET /v1/app/{app_id}

Read an application, its UID and its endpoint count.

Event types

POST /v1/event-type

Register names like invoice.paid with an optional JSON Schema for the payload.

Endpoints

POST /v1/app/{app_id}/endpoint

Add a customer URL, filter it to selected event types and set a rate limit.
POST /v1/app/{app_id}/endpoint/{id}/secret/rotate

Issue a new signing secret; the old one stays valid for 24 hours.

Messages

POST /v1/app/{app_id}/msg

Send an event. Pass eventId and VelosCore drops duplicates for 24 hours.
GET /v1/app/{app_id}/msg

List and filter sent events by type, date or channel.

Attempts and recovery

GET /v1/app/{app_id}/attempt/msg/{msg_id}

Every delivery attempt with status code, latency and response body.
POST /v1/app/{app_id}/endpoint/{id}/recover

Replay all failed events to an endpoint since a given timestamp.

Consumer portal

POST /v1/auth/portal-access/{app_id}

Get a short-lived magic link so your customer can manage endpoints and logs.

Limits and billing

You pay for events you send. Retries, replays and events with no subscribed endpoint are not counted.

See full pricing →

Plan limits

Plan limits
Limit	Developer	Growth	Scale
Price	$0	$49 / month	Contract
Events included	25,000 / mo	1,000,000 / mo	10M+ / mo
Overage	Not available	$0.90 per 100k	Volume rate
Throughput	20 msg/s	200 msg/s	1,000+ msg/s
Payload retention	3 days	30 days	90 days

Maximum payload size is 256 KB on every plan.

Questions engineers ask first

What counts as one event?

One call to the send-message endpoint is one billable event, no matter how many endpoints receive it. Retries, and events filtered out because no endpoint subscribes to that type, are free.

What happens when a customer's endpoint is down?

Any response other than 2xx, or no response within 15 seconds, is a failed attempt. VelosCore retries 8 times over about 27 hours with backoff. If an endpoint keeps failing for 5 days we disable it and email your team and the endpoint owner.

How do my customers verify that a webhook came from us?

Each request carries webhook-id, webhook-timestamp and webhook-signature headers following the Standard Webhooks spec. The signature is HMAC-SHA256 over the ID, timestamp and body. Our SDKs include a verify function, and any HMAC library works too.

Can I resend events after a customer fixes their server?

Yes. Resend a single message from the dashboard or API, or call the recover endpoint to replay every failed event since a timestamp. Replays are not billed as new events.

Are events delivered in order, and exactly once?

Delivery is at least once. Each event keeps the same webhook-id across retries, so receivers can drop duplicates. Ordering is best effort; include a timestamp or version in your payload if order matters to your customers.

How long do you keep payloads, and can I delete them?

Payloads are kept for 3, 30 or 90 days depending on plan, then deleted. You can export message logs as JSON at any time and delete an application with all its data through the API.

Send your first signed webhook today.

Start on the free Developer plan and move to Growth when you go live.

Compare plans Email business@veloscore.online