Documentation

Conduit uses two auth models. JWTs power the dashboard experience and user session. API keys are for programmatic access to endpoint management, delivery logs, and simulator endpoints.

This first documentation view emphasizes structure and clarity: top-level docs plus four representative endpoints that demonstrate unauthenticated auth flows, JWT-protected key creation, API-key endpoint management, and webhook ingestion.

{
  "username": "danny",
  "email": "danny@example.com",
  "password": "strong-password"
}

{ "message": "user created" }

curl -X POST https://conduit-api.useshipyard.xyz/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "danny",
    "email": "danny@example.com",
    "password": "strong-password"
  }'

Conduit understands the signing models of common provider ecosystems and can infer the sender by signature header presence alone.

GitHub

Paste repository webhook secret into Conduit

Find the signing secret in your repository or organization webhook settings. Use the generated Conduit inbound URL as the webhook URL and map GitHub events like push or pull_request into your subscribed event list.

Stripe

Replay-safe with 5 minute window

Copy the Stripe signing secret from the Developers → Webhooks section, paste it into the Conduit endpoint secret field, and subscribe to events such as payment.failed or invoice.paid.

Paystack

HMAC-SHA512 verification

Use your dashboard secret key-derived signature flow and point Paystack to the Conduit inbound URL. Choose subscribed events that mirror the incoming body.event names.

Slack

Replay-safe with 5 minute window

Configure Slack Events API to POST to your Conduit inbound URL using the signing secret from your app settings. Slack events are identified in body.event.type or body.type depending on the event type.

Shopify

Base64 HMAC-SHA256 signature

Copy your webhook signing secret from the Shopify Admin API credentials and configure your webhook URL to point to Conduit. Map Shopify topics like orders/create or products/update from the x-shopify-topic header.

Inbound events are verified, persisted, queued, consumed, delivered, retried, and eventually marked dead if recovery never succeeds within the retry policy.

Retry schedule

Every outbound webhook Conduit delivers includes X-Conduit-Signature. Compute an HMAC-SHA256 of the raw request body using your endpoint secret and compare it with a timing-safe function.

const crypto = require('crypto')

function verifyConduitSignature(req, secret) {
  const signature = req.headers['x-conduit-signature'];
  const hmac = crypto.createHmac('sha256', secret);
  const expected = 'cdtsig_sha256=' + hmac.update(req.rawBody).digest('hex');

  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

Conduit keeps ingestion and delivery independent. The API process receives and persists data. The worker process consumes queued jobs later and handles retries without blocking the ingest path.