This page covers how Mamo delivers webhooks, what happens on failure, and how to verify requests. To register an endpoint, see Register a Webhook.
Registration requires a reachable endpoint
When you register a webhook, Mamo immediately sends a test request with the body {"ping": "pong"}. Your endpoint must respond with a 2xx status or registration is rejected with Webhook is unreachable (HTTP 422). Make sure your endpoint is live and publicly reachable before registering.
Sandbox and live are separate environments with separate API keys — register your webhook in each environment separately.
Retries
If a delivery attempt fails (your endpoint does not return a 2xx), Mamo retries:
- Up to 5 attempts per event
- A fixed 30-minute wait between attempts (not exponential backoff)
After the 5th failed attempt the event is dropped and not retried further. Design your endpoint to return 2xx quickly and do heavy processing asynchronously, so a slow handler doesn't cause an unnecessary retry.
Verifying requests
Mamo webhook requests are not signed — there is no HMAC signature header to validate. Verify authenticity instead by:
auth_header— the value you set when registering the webhook is sent back on every request in theAuthorizationheader. Set a secret value and check it on each incoming request.
Treat a request whose Authorization header doesn't match your configured auth_header as untrusted.
Idempotency
The same event may be delivered more than once (for example, a 2xx that arrived after a timeout, or a retry). Make your handler idempotent — key on the event's id and ignore duplicates.