All documentation
Authentication

Webhooks: Security and Production Checklist

Protect production receivers with HTTPS, signature verification, replay checks, payload validation and safe logging.

Text

Overview

Webhook signatures authenticate the request transport, but receivers still need normal application security. PulseGrid includes identifying headers such as delivery ID, endpoint ID, event name, timestamp and signature. The JSON body remains the source of truth for business content.

Setup

Production checklist: 1. Use HTTPS. 2. Store signing secrets in environment variables or a secrets manager. 3. Verify signatures using the raw body. 4. Enforce timestamp tolerance to reduce replay risk. 5. Deduplicate delivery_id. 6. Validate JSON shape and expected data types. 7. Apply your own authorization/business rules after identifying project.id. 8. Limit request body size. 9. Avoid logging secrets or unnecessary sensitive payloads. 10. Keep the handler fast; queue slow work. 11. Rotate the secret immediately if exposed. 12. Monitor repeated failures and pause endpoints during receiver maintenance.

Code example

Webhooks: Security and Production Checklist
Text 
Typical delivery headers:
X-PulseGrid-Delivery: <delivery-uuid>
X-PulseGrid-Endpoint: <endpoint-uuid>
X-PulseGrid-Event: delivery.updated
X-PulseGrid-Timestamp: <unix-seconds>
X-PulseGrid-Signature: v1=<hmac-sha256>
User-Agent: PulseGrid-Webhooks/1.0

Notes

Rotating a signing secret invalidates the old secret immediately. Coordinate the PulseGrid endpoint and receiver deployment so legitimate deliveries are not rejected during rotation.