Verifying a webhook is really from Veluril
Your endpoint's URL is public, so anyone could send a webhook to it. That's why every webhook we send is signed with your endpoint's own secret. Before your endpoint acts on a webhook, it can check the signature and verify the webhook really came from Veluril.
How the signature works
Every webhook includes an X-Veluril-Signature header. It holds the time we sent the webhook, and a signature made from that time and the webhook's contents using your endpoint's signing secret. Only Veluril and you have the secret. So when your endpoint makes the same signature and it matches, the webhook is ours and nothing in it has changed on the way.
Our developer guide, Verifying webhook signatures, walks through the whole check with working code.
Keeping the secret safe
We show the signing secret once, when you add the endpoint. Keep it secured the way you would a password.
We keep only an encrypted copy of your signing secret. That's why we can't show it to you again, so copy it somewhere safe the moment you see it.
Rotating the secret
If you lose the secret, or think someone else has seen it, open the endpoint from your Webhooks page and click the "Rotate secret" button:
Once you confirm, the old secret stops working immediately and we show the new one, once. Update your endpoint with it straight away. Until you do, your endpoint will turn our webhooks away, and we keep retrying them while you update it.
Next
If your tool or script gets an error back when it creates a delivery, the code tells you what to fix.