topic
Verified 2026-09-18Secure Webhooks
Webhooks deliver HTTP callbacks from one service to another and must be treated as untrusted, replayable input.
Sign a canonical payload with a timestamp and event identifier, verify signatures before parsing sensitive fields, reject stale replays, respond quickly, and process delivery asynchronously with deduplication.
httpapisecuritywebhooksintegrity
Reference (http)
POST /hooks/orders HTTP/1.1 X-Webhook-Timestamp: 1720000000 X-Webhook-Signature: v1=BASE64_SIGNATURE
Sign a canonical payload with a timestamp and event identifier, verify signatures before parsing sensitive fields, reject stale replays, respond quickly, and process delivery asynchronously with deduplication.
Common mistakes
- Using the webhook URL as the only secret, accepting unsigned retries, or performing slow business work before acknowledging delivery.