# Quick Reference

One-page lookup for all technical specifications. Explanations live in the linked pages.

## Delivery Specifications

| Specification | Value |
|  --- | --- |
| **Protocol** | HTTPS only (valid CA-issued certificate, TLS 1.2+) |
| **Method** | POST |
| **Content type** | `application/json` |
| **Response timeout** | 15 seconds |
| **Success codes** | `200 OK`, `202 Accepted`, `204 No Content`; anything else retries |
| **Retry pattern** | 5→10→20→40→80 min, repeating; max delay 80 min ([details](/echosync-webhooks/reliability)) |
| **Deregistration threshold** | Per webhook (event type): 25 consecutive failures **and** 2+ days elapsed; any success resets both |
| **Signature** | HMAC-SHA256 over raw body, base64-encoded, using your Signing Secret |
| **Retry payload** | Identical across retries; only delivery headers change |


## Source IP Addresses (for allowlisting)

Static egress IPs, guaranteed not to change. Allowlist all four; the reserved pair may come into use without notice.

| Status | IP addresses |
|  --- | --- |
| **Active** | `3.19.83.191``18.118.90.214` |
| **Reserved** | `32.188.140.83``35.80.104.162` |


## Request Headers

| Header | Purpose |
|  --- | --- |
| `X-Echo-Hmac-SHA256` | Payload signature; verify with your Signing Secret |
| `X-Echo-Timestamp` | Current attempt timestamp (UTC ISO 8601) |
| `X-Echo-Timestamp-Original` | First attempt timestamp |
| `X-Echo-Retry-Attempt` | `0` initial, increments per retry |
| `X-Echo-Webhook-Id` | Unique event Id; use for idempotency |
| `Authorization` | OAuth bearer token or Basic Auth credentials, if configured |
| API key / custom headers | As configured at registration |


Details and retry behavior: [Receiving & Verifying Webhooks](/echosync-webhooks/technical-implementation)

## Signing Secret (Required)

You create it and give it to Echo at registration; Echo does not assign it. Echo signs every payload with it; you verify. Not to be confused with endpoint authentication below, or with an OAuth `client_secret`.

| Requirement | Specification |
|  --- | --- |
| **Length** | 24–128 characters |
| **Required characters** | 1 uppercase, 1 lowercase, 1 number |
| **Special characters** | Recommended, not required |


**Allowed symbols**

```text
@ # $ % & * ! ? [ ] { } ( ) < > + - _ . , : ; ~ ` ^ | \ /
```

## Endpoint Authentication (Optional, Recommended)

Credentials Echo presents so your endpoint/gateway accepts the request. Does not replace the Signing Secret.

| Method | Configuration |
|  --- | --- |
| **API key** | Your header name + value, sent on every request |
| **Basic Auth** | Header pair: `Authorization` + `Basic <base64(username:password)>`; mutually exclusive with OAuth |
| **OAuth 2.0** | Client credentials flow: `endpoint`, `client_id`, `client_secret`, `grant_type=client_credentials` (+ optional `scope`, `audience`) |
| **Custom headers** | Any name/value pairs, sent on every request |


## Onboarding at a Glance

| Step | Action |
|  --- | --- |
| 1 | Create Signing Secret; prepare separate testing + production URLs |
| 2 | Email registration to Technical Integrations |
| 3 | Validate test payloads in the testing environment |
| 4 | Confirm results; request production activation |


Full walkthrough: [Onboarding & Registration](/echosync-webhooks/getting-started)