A clearer delivery trail for GitHub.

Create the endpoint

Create an endpoint in ShellOrbit and give it a name that identifies the provider and environment. Add your application’s public HTTPS handler as a destination.

Copy the ingest URL into GitHub’s webhook or notification configuration. Subscribe only to the event types your application needs.

Configure verification

In endpoint settings, choose GitHub and enter the shared webhook secret configured in GitHub. Select Quarantine for invalid signatures, then save and enable verification.

Verification reads X-Hub-Signature-256 and the original body. See the official GitHub verification instructions for provider-specific configuration.

Test delivery

Send a test event through the provider. Open Events in ShellOrbit, check the signature result, and inspect the destination’s response. Fix verification failures before enabling live traffic.

Verify forwarded requests

Your receiving handler should verify the fresh ShellOrbit signature. Original provider headers are useful evidence, but timestamped provider signatures may expire during retries and no longer match a transformed body.

Handle duplicate events

Use the provider’s event identifier in your application’s idempotency check. A transport failure or manual replay can deliver an event more than once.

Recover after an interruption

Inspect failed deliveries and use a recovery preview before starting a larger replay. Events that never reached ShellOrbit require recovery through the provider’s own tools; a relay cannot replay data it never received.

Browse every integration · Read about delivery guarantees

Compare missing deliveries

The repository webhook reconciliation workflow compares GitHub history with trusted acceptance receipts before requesting anything. Configure credentials in endpoint settings, then use Compare only. See the GitHub reconciliation guide for permission requirements, canary approval, retention, and cancellation.

Watch your GitHub tokens and repos

Personal access tokens and app keys leak through commits more often than anywhere else. Leak Alarm scans the repos you connect on every push, alerts you within seconds when one is made public, and on Pro and Business can revoke a leaked GitHub token. See GitHub repos.