Expose a public HTTP endpoint or webhook receiver from a Convex backend using httpRouter and httpAction in convex/http.ts

Documented steps

1. Create convex/http.ts.
2. Import the router and action wrapper: import { httpRouter } from "convex/server"; import { httpAction } from "./_generated/server";
3. Instantiate the router: const http = httpRouter();
4. Define a handler with httpAction, receiving a standard Fetch API Request: const handleWebhook = httpAction(async (ctx, request) => { const body = await request.json(); ...; return new Response(null, { status: 200 }); });
5. Register it on an exact path: http.route({ path: "/postMessage", method: "POST", handler: handleWebhook }); use pathPrefix instead of path (e.g. "/getAuthorMessages/") to match all routes beginning with that prefix.
6. Inside the handler call ctx.runQuery/ctx.runMutation/ctx.runAction (typically with internal.* references) to read or write data — the ctx is an ActionCtx, not a raw db handle.
7. Export the router as the file's default export: export default http; — required for route discovery.
8. Store the provider's signing secret as a Convex environment variable (npx convex env set STRIPE_WEBHOOK_SECRET 'xxx') and read it via process.env in the handler.
9. Because HTTP actions are publicly reachable with no built-in auth, manually verify the webhook signature/secret against the request before trusting the payload.
10. After deploying, the endpoint is served at https://<deployment-name>.convex.site/<path> — the .convex.site domain, NOT the .convex.cloud domain used by the normal Convex client.
11. If called from a browser, handle CORS explicitly: respond to preflight OPTIONS requests and set Access-Control-Allow-Origin headers.
12. Official docs: https://docs.convex.dev/functions/http-actions