Configure Webhooks
Register an HTTPS receiver and protect its one-time secret.
In Dashboard → Developers → Webhooks, add a public HTTPS endpoint controlled by your backend. Endpoint creation returns secret and keyId; store the secret immediately because it is shown once.
Your handler should:
- accept
POSTrequests over HTTPS; - retain the exact raw UTF-8 request body;
- enforce a small request-size limit;
- verify every v2 header and the HMAC before using JSON data;
- deduplicate
X-Event-Idin durable storage; - return
2xxafter durable acceptance.
Rotating a secret returns a new secret and key ID for future deliveries. Already-created deliveries retain their signing snapshot, so retain old secrets long enough to verify outstanding deliveries identified by X-Key-Id.
Project readiness requires at least one active endpoint. Use the test action before accepting live traffic.