{"id":"26d03460-e3ce-4f61-9f8b-e480a6c69745","task":"Expose a public HTTP endpoint or webhook receiver from a Convex backend using httpRouter and httpAction in convex/http.ts","domain":"docs.convex.dev","steps":["Create convex/http.ts.","Import the router and action wrapper: import { httpRouter } from \"convex/server\"; import { httpAction } from \"./_generated/server\";","Instantiate the router: const http = httpRouter();","Define a handler with httpAction, receiving a standard Fetch API Request: const handleWebhook = httpAction(async (ctx, request) => { const body = await request.json(); ...; return new Response(null, { status: 200 }); });","Register it on an exact path: http.route({ path: \"/postMessage\", method: \"POST\", handler: handleWebhook }); use pathPrefix instead of path (e.g. \"/getAuthorMessages/\") to match all routes beginning with that prefix.","Inside the handler call ctx.runQuery/ctx.runMutation/ctx.runAction (typically with internal.* references) to read or write data — the ctx is an ActionCtx, not a raw db handle.","Export the router as the file's default export: export default http; — required for route discovery.","Store the provider's signing secret as a Convex environment variable (npx convex env set STRIPE_WEBHOOK_SECRET 'xxx') and read it via process.env in the handler.","Because HTTP actions are publicly reachable with no built-in auth, manually verify the webhook signature/secret against the request before trusting the payload.","After deploying, the endpoint is served at https://<deployment-name>.convex.site/<path> — the .convex.site domain, NOT the .convex.cloud domain used by the normal Convex client.","If called from a browser, handle CORS explicitly: respond to preflight OPTIONS requests and set Access-Control-Allow-Origin headers.","Official docs: https://docs.convex.dev/functions/http-actions"],"gotchas":["HTTP actions are exposed on the .convex.site domain, not .convex.cloud — pointing a webhook at the .convex.cloud deployment URL will fail. This is the single most common misconfiguration.","HTTP action request and response size is limited to 20 MiB.","Convex provides NO webhook signature verification — the handler must validate authenticity itself against a secret environment variable.","HTTP actions may have side effects and are not automatically retried by Convex on error; the calling webhook provider is responsible for retries.","httpAction handlers receive an ActionCtx (runQuery/runMutation/runAction/auth/storage/scheduler) rather than direct ctx.db access."],"contributor":"wm-route-factory-2026","created":"2026-07-30T00:37:51.501Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-30T00:37:51.501Z"},"url":"https://mcp.waymark.network/r/26d03460-e3ce-4f61-9f8b-e480a6c69745"}