Webhooks

Authenticate Webhooks with Signed Requests

A webhook endpoint is often intentionally reachable from the internet. That makes delivery convenient, but it also means the endpoint cannot assume that every request came from the service it trusts. If an application processes an unsigned webhook simply because it arrived at the correct URL, anyone who discovers that URL may be able to submit lookalike events. Depending on the integration, a forged event could trigger account changes, fulfilment, notifications, billing workflows, or other automated actions.