Webhook event delivery fails - I've tried everything :(

Devices & Integrations
1

Hi everyone,

Losing my mind trying to get webhooks working… Here’s the details and how I’ve literally tried troubleshooting everything i can think of…

Setup:

  • SmartThings Hub v2, firmware 000.060.00012
  • API_ONLY app created via CLI, target URL via Cloudflare Tunnel to local Homebridge instance
  • Plugin: homebridge-smartthings-oauth (this isn’t a plugin issue)

What’s working:

  • OAuth completes successfully - token contains installed_app_id, location_id, and all *_account_id fields
  • Target URL status: CONFIRMED
  • 10 CAPABILITY subscriptions created successfully via API
  • DEVICE-type subscription created successfully via API
  • SmartThings CONFIRMATION lifecycle received and acked correctly
  • Manual POST through tunnel processed correctly end-to-end
  • Device history confirms events reach the SmartThings cloud when devices are flipped
  • All locationIds match across installedApp, subscriptions, and devices

What’s not working:

  • SmartThings never sends any events to the target URL
  • Cloudflare Security Events log shows zero inbound requests - SmartThings is not attempting delivery at all
  • Tested both CAPABILITY and DEVICE subscription types - neither delivers

Already ruled out:

  • Network/TLS issues (CONFIRMATION POST came through fine)
  • Cloudflare blocking (zero firewall events, free plan - no Bot Fight Mode)
  • Location mismatch (all three locationIds identical)
  • Capability mismatch (device capabilities match subscriptions)
  • Local vs cloud execution (cloud-native virtual switch also produced zero delivery)
  • Subscription type (both CAPABILITY and DEVICE fail identically)

Has anyone seen this behavior? Is there any account-level setting or platform flag that could silently disable webhook event delivery?

3

Resolved - root cause was Cloudflare silently dropping SmartThings event POSTs

Sharing this in case it helps anyone else hitting the same wall.

Symptoms:

  • API_ONLY app target CONFIRMED, subscriptions created successfully (both CAPABILITY and DEVICE types)
  • Device events reaching SmartThings cloud (visible in device history)
  • Zero webhook deliveries - Cloudflare security logs showed no blocked requests, no firewall events at all

Root cause:
Cloudflare was silently dropping SmartThings’ event POSTs without logging them. The CONFIRMATION handshake worked fine (different traffic path), which made Cloudflare look innocent. Only when switching to ngrok did events immediately start flowing, isolating Cloudflare as the variable.

Fix:
Add a Cloudflare WAF custom rule:

  • Field: IP Source Address
  • Operator: is in
  • Value: 18.221.0.0/16 (AWS us-east-2 - SmartThings event delivery infrastructure)
  • Action: Skip - All remaining custom rules + All managed rules

Events now flow in real-time through the Cloudflare Tunnel with no issues.

Note: If events stop in the future, check whether SmartThings has moved delivery to a different IP range - use ngrok to capture the source IP and update the WAF rule accordingly.

Hope this saves someone the debugging time.