---
title: "HMAC-Signed Webhooks, Exponential Retries, and Dead-Letter Queues: Why It Matters for Insurance Integrations"
description: "The difference between a hobbyist webhook system and a production one is signing, retries, and a DLQ. Here's how unLocked CRM ships all three out of the box."
url: https://unlockedcrm.ai/blog/hmac-signed-webhooks-insurance-crm
canonical: https://unlockedcrm.ai/blog/hmac-signed-webhooks-insurance-crm
category: "Engineering"
published: 2026-07-30
updated: 2026-07-30
author: "unLocked Team"
source: unLocked CRM — AI CRM for insurance agents
---

# HMAC-Signed Webhooks, Exponential Retries, and Dead-Letter Queues: Why It Matters for Insurance Integrations

<p>Webhook security is one of the most under-discussed parts of an insurance CRM's API. PII flows through these payloads — names, dates of birth, plan IDs, sometimes premium amounts — and a webhook receiver that can't verify the sender is a phishing target waiting to be exploited.</p>

<h2>HMAC-SHA256 Signing, Stripe-Style</h2>
<p>Every unLocked webhook ships with a header in the form <code>t=1714000000,v1=&lt;hex&gt;</code>. Your endpoint computes <code>HMAC-SHA256(timestamp + "." + raw_body, shared_secret)</code> and constant-time compares it to <code>v1</code>. If it matches and the timestamp is fresh (typically within 5 minutes), the request is authentic. This is the same pattern Stripe popularized and is now table-stakes for production webhook systems.</p>

<h2>Exponential-Backoff Retries</h2>
<p>Network glitches, deploys, brief downtime — receivers fail. unLocked retries on a ladder: 1 minute, 5 minutes, 30 minutes, 1 hour, 3 hours, 6 hours. After 6 failed attempts, the delivery moves to the dead-letter queue, where it can be replayed from the dashboard once the underlying issue is fixed.</p>

<h2>The pg_cron Retry Worker</h2>
<p>Retries are coordinated by a <code>webhook-retry-worker</code> Edge Function scheduled by pg_cron. Workloads are idempotent and durable across deploys — there is no in-memory queue to lose on restart.</p>

<h2>Why Insurance Especially</h2>
<p>Carrier feeds, commission statements, application status updates — all of these arrive asynchronously and downstream systems (AMS, accounting, agent dashboards) can't tolerate silent drops. Signed + retried + DLQ'd webhooks are the only architecture that holds up under audit.</p>

---

Source: [HMAC-Signed Webhooks, Exponential Retries, and Dead-Letter Queues: Why It Matters for Insurance Integrations](https://unlockedcrm.ai/blog/hmac-signed-webhooks-insurance-crm) — unLocked CRM, the AI CRM built for insurance agents. Citation permitted with attribution and a link to https://unlockedcrm.ai/blog/hmac-signed-webhooks-insurance-crm.