For developers: reliable webhooks and API keys that rotate without downtime
Integrations tend to fail when a receiver goes down or a credential has to change. Essence webhooks wait and replay, and its secrets and keys rotate with an overlap, so both become planned work.
Your receiving server goes down during a release and misses an hour of events. A signing secret has to change, and two teams have to agree on the exact minute to swap it. Neither is a disaster, but both tend to land outside working hours.
Essence handles both on the sending side. Its webhooks wait for your endpoint and can replay what it missed, and its secrets and API keys change with a handover window. Your developers fix things when it suits them, not when the clock forces them to.
When your endpoint is down
When something happens that your systems care about, Essence sends a webhook. If your endpoint returns errors, the delivery is not dropped. The default policy tries again five times, at 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours. That spread covers a quick restart and a long bad night alike, without hammering a server that is already struggling.
If every retry fails, the delivery is parked rather than retried forever. The parked delivery keeps its payload, the number of attempts and the last response your endpoint gave.
Since our August release, parked deliveries can be sent again. Once your endpoint is healthy, you ask for them to be redriven. The replay is recorded as a new delivery that points back to the original, and the original keeps its parked status, so the history stays true after the event.
A redrive request is also safe to repeat. If your call times out and you send it again, Essence does not queue a second replay of the same delivery. Pair that with a receiver that ignores events it has already handled, and an outage on your side becomes a short task: fix the endpoint, redrive, carry on.
Changing a signing secret without a cut-over
Every webhook payload is signed with HMAC-SHA256 using a secret shared with your organisation, and your receiver checks the signature before it trusts the content.
Secrets have to change from time to time: when someone leaves, when one may have been exposed, or on a schedule. The awkward part has always been the swap. If the sender changes first, your receiver rejects good events. If you change first, you reject them anyway.
Overlapping rotation has been part of the webhook service since June 2026. When you rotate, you receive the new secret once. It is stored encrypted and never shown again. The previous secret stays valid until a stated time, which the response gives you: 24 hours by default, and up to 7 days if you ask. During that window both secrets produce valid signatures, so you deploy the new one at a sensible hour. After it, the old one stops working.
API keys with a handover window
In our September release the same idea reached API keys, the credentials your systems present when they call Essence.
When you rotate a key, you can ask for an overlap of up to 24 hours, during which both the old and the new key are accepted. Rotate without an overlap and the old key is revoked at once. That is the path for the day a key has leaked and you want it dead now.
Three rules keep the overlap honest:
- A key already in its overlap cannot be rotated again. You rotate its successor instead, so nobody can keep a retired key alive by rotating it over and over.
- The end of the overlap is checked every time the key is used, as expiry is. The old key stops on time because each request checks it, not because a background job happened to run.
- The new key carries the same permissions as the old one, so an integration keeps its access at the moment it is re-keyed.
The same release also gave API keys a field for the organisation they belong to, so a key can be tied to an organisation rather than only to the person who created it.
What changes for your team
A missed hour of events becomes a redrive. A secret or key change becomes a deployment with a clear start and a clear end, scheduled for a working day. If your team is planning an integration with Essence, we would be glad to walk your developers through the detail.
Published 22 October 2026