Sent to matching subscriptions in both the source and destination workspaces after a transfer commits. The deliveries share an event ID; workspace_id identifies the recipient workspace.

Lovable sends a signed HTTPS POST to the configured destination. Any 2xx response acknowledges delivery; its body is ignored. Network errors, 408, 429, and 5xx are retried, with at most eight attempts within 24 hours and a five-second timeout per attempt. Other responses are terminal. Deliveries may be duplicated and are not ordered. Deduplicate by webhook-id, which stays constant across attempts. Verify Standard Webhooks HMAC-SHA256 signatures over webhook-id.webhook-timestamp.raw_body using the exact header values and unmodified body bytes. Signing secrets use whsec_ followed by base64; decode the suffix to obtain the signing key. webhook-signature contains space-separated v1,base64 signatures. Accept a matching signature using a trusted key and constant-time comparison. Validate webhook-timestamp freshness in Unix seconds before processing. The timestamp and signature are refreshed for each attempt. An optional destination bearer token is sent in the Authorization header in addition to these headers. Ignore unknown JSON properties to allow additive contract changes.