Secure webhook ingestion.
Webhook Safe Cloud verifies incoming webhook signatures before accepting events for delivery. Verification depends on the provider configured for each endpoint.
Signature verification
Webhook Safe supports five provider types. Stripe, GitHub, Shopify, and Slack require a signing secret. Generic webhooks can optionally use HMAC signature verification.
Use signing secrets in production
A generic endpoint without a signing secret accepts unsigned webhooks. Configure a secret when you need to authenticate incoming requests.
| Provider | Signature header | Secret |
|---|---|---|
| Slack Events API | x-slack-signature and x-slack-request-timestamp | Required; five-minute timestamp window |
| Generic | x-webhook-signature | Optional |
| Stripe | stripe-signature | Required |
| GitHub | x-hub-signature-256 | Required |
| Shopify | x-shopify-hmac-sha256 | Required |
Configure a signing secret
Provide the signingSecret field when creating an endpoint through the management API.
curl -X POST "$BASE_URL/v1/endpoints" \
-H "Authorization: Bearer $API_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"id": "github-production",
"name": "GitHub production",
"destinationUrl": "https://your-app.example/webhooks",
"provider": "github",
"signingSecret": "REPLACE_WITH_YOUR_SECRET"
}'The signing secret is not included in the endpoint creation, listing, or detail responses. The current update API supports changing only the endpoint's enabled state, not its secret.
Verification uses the original payload
Provider signature verification operates on the raw request payload. Webhook Safe does not parse and reserialize the JSON before checking Stripe, GitHub, or Shopify signatures.
This matters because even small changes to whitespace or serialization can invalidate a signature.
Destination safety
Before forwarding an event, Webhook Safe validates the destination URL and uses a safety-aware DNS lookup to reduce the risk of requests reaching prohibited network addresses.
Outbound delivery requests use HTTP POST, have a 30-second timeout, and do not follow HTTP redirects.
Management API authentication
Management routes under /v1/endpoints, /v1/events, and /v1/operations require Bearer authentication.
curl "$BASE_URL/v1/endpoints" \
-H "Authorization: Bearer $API_TOKEN"Incoming webhook requests to /v1/webhooks/:endpointId do not use the management API token. They are authenticated through the configured provider signature verification instead, when a signing secret is required or configured.
Public website analytics
When enabled, we use Cloudflare Web Analytics to understand visits, public page views, referrals and page performance. Analytics is limited to the public website; login, recovery and private workspace pages are excluded. We do not supply account identifiers, credentials or webhook contents to analytics.
Cloudflare states that this product does not use analytics cookies, localStorage or visitor fingerprinting. Loading its script and reporting measurements still involves browser requests to Cloudflare. See Cloudflare Web Analytics and Cloudflare’s privacy policy for provider information.
Our integration skips measurement when your browser sends Global Privacy Control or Do Not Track. It also excludes URLs containing queries or fragments and some referrals. Counts are estimates and do not identify individual visitors. Privacy questions: linustrulsson1982@gmail.com.