{"slug": "building-scalable-webhooks-with-cloudflare-workers", "title": "Building Scalable Webhooks with Cloudflare Workers", "summary": "A developer outlined an edge-native webhook architecture built on Cloudflare Workers and Queues, in which an edge worker verifies HMAC-SHA256 signatures, enqueues payloads, and returns a 202 immediately while a separate queue consumer handles processing with retries. The pattern is demonstrated by Codra, an open-source self-hosted AI code review engine for GitHub pull requests that uses Workers and Queues to run an edge-native review loop without server maintenance.", "body_md": "Handling webhooks at scale presents a unique set of engineering challenges. When a third-party service (like GitHub, Stripe, or Twilio) sends an event to your application, it expects a fast, reliable, and secure response. If your server is slow, the provider might time out. If you receive a sudden spike in events, your backend could be overwhelmed.\n\nCloudflare Workers provide a highly effective solution for this problem. By deploying serverless functions to the edge, you can intercept, validate, and queue webhooks globally with near-zero latency. In this tutorial, we will explore the best practices for building a resilient webhook architecture and introduce [Codra](https://codra.run), an open-source AI code review engine, as a reference implementation.\n\nWhen building a webhook receiver, developers must account for several critical factors:\n\nCloudflare Workers operate at the network edge, running within milliseconds of the user or provider making the request. They offer:\n\nTo build a scalable webhook system, follow a decoupled approach. The edge worker should only validate the request and push it to a queue.\n\nNever trust an incoming webhook without verifying its cryptographic signature. Providers like GitHub include a signature in the headers based on a shared secret. You can compute the HMAC signature in your Worker and compare it using a constant-time comparison to prevent timing attacks.\n\n``` js\nexport async function verifySignature(request, secret) {\n  const signature = request.headers.get('x-hub-signature-256');\n  if (!signature) return false;\n\n  const body = await request.clone().text();\n  const encoder = new TextEncoder();\n\n  const key = await crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n\n  const signed = await crypto.subtle.sign('HMAC', key, encoder.encode(body));\n  const expectedSignature = 'sha256=' + Array.from(new Uint8Array(signed))\n    .map(b => b.toString(16).padStart(2, '0'))\n    .join('');\n\n  return signature === expectedSignature;\n}\n```\n\nDo not process the webhook payload synchronously. Instead, push the payload to a message queue and return a 200 status code immediately. Cloudflare Queues are perfect for this.\n\n```\nexport default {\n  async fetch(request, env) {\n    if (request.method !== 'POST') {\n      return new Response('Method not allowed', { status: 405 });\n    }\n\n    const isValid = await verifySignature(request, env.WEBHOOK_SECRET);\n    if (!isValid) {\n      return new Response('Unauthorized', { status: 401 });\n    }\n\n    const payload = await request.json();\n\n    // Push to Cloudflare Queue\n    await env.WEBHOOK_QUEUE.send(payload);\n\n    return new Response('Accepted', { status: 202 });\n  }\n};\n```\n\nA separate queue consumer handles the heavy lifting. This is where you can implement retries and long-running tasks without worrying about the webhook provider timing out.\n\n``` js\nexport default {\n  async queue(batch, env) {\n    for (const message of batch.messages) {\n      try {\n        await processEvent(message.body);\n        message.ack();\n      } catch (error) {\n        console.error('Processing failed', error);\n        message.retry();\n      }\n    }\n  }\n};\n```\n\nIf you are looking for a production-ready example of this architecture, check out [Codra](https://codra.run). Codra is an open-source, self-hosted AI code review engine designed specifically for GitHub pull requests. While Codra supports containerized Docker and Node.js deployments via BullMQ, its serverless deployment profile leverages Cloudflare Workers and Queues to provide an edge-native review loop with zero server maintenance ([see the Cloudflare Workers deployment guide](https://codra.run/docs/cloudflare)).\n\nCodra leverages this decoupled webhook pattern to handle pull request events efficiently. When a developer pushes code, GitHub sends a webhook to the Codra ingestion worker. The worker verifies the payload and queues the review task, ensuring GitHub never experiences a timeout.\n\nCodra focuses on providing a superior developer experience through several key features:\n\nBy examining the [Codra repository](https://github.com/devarshishimpi/codra) or reviewing its [architecture overview](https://codra.run/docs), developers can see how to structure large-scale Worker applications, manage secrets, and handle complex asynchronous workflows.\n\nBuilding webhook infrastructure requires anticipating scale from day one. By utilizing Cloudflare Workers and Queues, developers can build a robust ingestion layer that handles traffic spikes gracefully and processes data securely. Open-source projects like Codra provide excellent blueprints for implementing these patterns in real-world scenarios.", "url": "https://wpnews.pro/news/building-scalable-webhooks-with-cloudflare-workers", "canonical_source": "https://dev.to/codra/building-scalable-webhooks-with-cloudflare-workers-2d69", "published_at": "2026-11-05 14:16:57+00:00", "updated_at": "2026-11-05 14:19:45.457603+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-infrastructure", "ai-agents"], "entities": ["Cloudflare", "Cloudflare Workers", "Cloudflare Queues", "Codra", "GitHub", "Stripe", "Twilio", "BullMQ"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/building-scalable-webhooks-with-cloudflare-workers", "markdown": "https://wpnews.pro/news/building-scalable-webhooks-with-cloudflare-workers.md", "text": "https://wpnews.pro/news/building-scalable-webhooks-with-cloudflare-workers.txt", "jsonld": "https://wpnews.pro/news/building-scalable-webhooks-with-cloudflare-workers.jsonld"}}