Why a webhook URL must be HTTPS

Set a workspace webhook URL in Settings, or pass webhookUrl on create/send. Inkpacket POSTs JSON when an envelope is sent, viewed, signed, completed, expired, declined, voided, or corrected. HTTPS is required except on localhost or .test hosts. That is webhook-https honesty: an http:// receiver is not queued, Settings will not “upgrade the scheme for you,” and opening Billing will not sell cleartext delivery.

Why there is no dry-run is why webhooks have no test-send. Why the table stops at twelve is why Settings only shows the last 12 webhook deliveries. How to verify the HMAC is webhook signature verify checklist. Desk help is Docs. This guide is why a plain http:// URL never joins the last 12, and why that refusal is not a failed secret.

Ask Inkpacket for why a webhook URL must be HTTPS to open this article. Ask how webhooks work to open help. Ask test webhook to open Settings. Those phrases stay on the product screens. This article is the public version of HTTPS is required except on localhost or .test hosts — the string help already uses next to the URL field.

What HTTPS covers

• https:// on a public host. That URL can be saved. Delivery is queued on the next event.
• http:// on localhost or a .test host. Local and test schemes stay allowed so a laptop receiver can run.
• http:// on any other host. That URL is refused. No delivery is queued.
• A missing URL. No delivery is queued. Envelope send still succeeds.

Saving a legal URL is not a send. An envelope you send after that save is. Free allows 5 packets a month. The first POST is attempted immediately. Failed deliveries retry on the hourly envelope job, up to 5 attempts. After 5 failures the row is marked failed. Settings shows the last 12 deliveries with status, attempt count, and last error. There is no test-send or replay button — send an envelope after saving a URL. An http:// public host never occupies a row in that twelve. HTTP 402 ENVELOPE_LIMIT is the monthly send cap, not a scheme cap.

What this is not

• Not a missing test-send. There is no test-send even when the URL is https://.
• Not webhook failed after 5 attempts. That row had a legal URL and a receiver that missed.
• Not Bearer token required. Webhook Settings is the desk. Public API uses a different door.
• Not checkout. Billing is not open. Paying a listed price does not allow public http://.

Each request includes X-Inkpacket-Event and X-Inkpacket-Signature. Verify with HMAC-SHA256 of timestamp.body using the workspace signing secret. Rotate the secret in Settings if it leaks. Members cannot mint API tokens; owners and admins set the webhook URL. Reminders go out by email today. Text-message (SMS) is coming soon. Email still soft-fails on the envelope that triggered the POST. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. None of those flags rewrite http:// into https://.

The click-path

1. Save an https:// URL in Settings, or http:// only on localhost or a .test host.
2. If the desk refuses the URL, change the scheme. Do not open Billing for cleartext.
3. Send an envelope. Confirm a row appears. There is still no test-send button.
4. If send returns HTTP 402 ENVELOPE_LIMIT, that is the monthly cap, not the URL scheme.
5. On a phone, tap Open desk menu for Settings. HTTPS is still required. Help is not a drawer row — it stays in the header.

When a POST misses after a legal URL, when webhook delivery fails. GET /api/v1/health needs no Bearer token and does not validate your receiver scheme. Ask Inkpacket for why a webhook URL must be HTTPS to open this article. Ask how webhooks work to open help.

Ask and the scheme

Ask Inkpacket for why a webhook URL must be HTTPS to open this article. Ask how webhooks work or webhook failed to open help. Ask test webhook to open Settings. Marketing Ask stays site Q&A and deep links. It will not save a URL, rewrite http://, or POST a signed body from this article. HTTPS is the public door. Localhost and .test are the exceptions.

Caps and what is not open yet

Refusing an http:// public host is not a send. Send that creates a delivery to a legal URL is. Free allows 5 packets a month. Free at 5 packets a month is the live cap desk send, bulk rows, Web Form fills, and API send share. Hitting it returns HTTP 402 ENVELOPE_LIMIT. Starter is 20 envelopes — more than Free — plus 3 published Web Forms. Seat counts are planning numbers; invite does not refuse when a workspace is full.

Billing is published, not charging. Checkout is not open. Text-message (SMS) is coming soon. Drive missing: Drive not configured. Stripe off: Payments not live. Those flags do not allow public http:// or invent a test-send. The FAQ and Webhooks use HTTPS is required except on localhost or .test hosts in the same words.

Save https://. Keep http:// on the laptop. Open a workspace on Free — see published pricing — and paste a throwaway http:// example.com so webhook-https honesty is a refused scheme you already saw, not a checkout you opened for cleartext this pass does not ship.