What your app gets
- Registered endpoints: each destination (say,
slack-alerts) is configured once with its URL and optional signing secret. - Reliable delivery: events are queued and delivered with automatic exponential-backoff retries over hours, not a single fire-and-forget attempt. Exhausted deliveries are kept, not discarded — they can be retried manually after the receiver recovers.
- Signed payloads: deliveries can carry a Stripe-style HMAC signature so the receiver can prove the event really came from your app.
- A full audit trail: every attempt and outcome is recorded per project — ask the agent for the delivery history of any endpoint.
Every delivery carries
- a unique delivery ID (receivers use it to deduplicate retries),
- the event type you assigned (receivers use it for routing),
- the signature when the endpoint is configured with a signing secret.
Good to know
- Destination URLs must be HTTPS.
- Signing secrets live in your project’s secret store.
- This replaces the fragile pattern of a bare
fetch()in a request handler — the agent uses it whenever your app promises to notify an external system, which also makes that promise verifiable.