Webhook Security
Receive notifications safely and make event processing robust against duplicates and retries.
Use HTTPS
Expose your webhook endpoint over HTTPS so notifications are encrypted in transit. Avoid plain HTTP endpoints, signing activity is sensitive data.
Validate incoming requests
Validate the structure and content of incoming notifications before processing them. Reject requests that don't match the expected format, and treat unexpected payloads as errors.
Documentation pending. Signature-based verification (signing header, secret provisioning and verification steps) is not yet published. Until then, restrict your endpoint to HTTPS, validate payload structure strictly, and log the full request context for manual review.
Reject malformed input
Notify your application when a notification is malformed or cannot be processed. Return an appropriate error so the sender knows the notification wasn't handled.
Log events safely
Log the event details you need to debug, event type, request reference and timestamps, without logging sensitive document contents or credentials.
Respond promptly
Return a response as soon as the notification is accepted, and process the event asynchronously where possible. A slow or missing response can trigger delivery retries.
Make processing safe to repeat
Notifications may be delivered more than once. Design event handling to be idempotent:
- Track which events you've already processed.
- Process the same event only once, even if the notification arrives again.
- Use the event's identifiers to deduplicate rather than relying on a single delivery.