Evnao documentation
Product setup, API access, and recovery paths.
Integrations
Pro workspaces can deliver tenant-scoped Evnao events to a public HTTPS endpoint from Settings → API & webhooks.
Read x-evnao-signature as t=TIMESTAMP,v1=HEX. Compute HMAC-SHA256(secret, timestamp + "." + rawBody), compare in constant time, and reject an old timestamp.
Database events create an outbox record after commit. Deliveries retry with exponential backoff, retain response/error history, and enter a dead state after eight attempts. Twenty consecutive failures disable the endpoint.
DNS is validated at setup and for every delivery. Private, loopback, link-local, credential-bearing, cross-origin redirect, and non-HTTPS destinations are rejected.
message.created never includes internal notes. Each envelope has id, type, createdAt, and data. Use x-evnao-delivery as the consumer idempotency key.