Anyone who finds your webhook URL can post fake events to it. Checking each delivery's signature is code you have to write, and keep right, in every service that receives webhooks.
The Verify webhook rule checks the signature at the edge, with the secret you share with the sender. A delivery without a valid signature gets a 401 and never reaches your server. And the secret is now write-only: once saved, neither the dashboard nor the API shows it again, and editing the rule keeps it unless you type a new one, as in the rule above.
What you can set
- Header, algorithm and prefix. For senders that sign the request body with your shared secret, using SHA-256 or SHA-1, such as GitHub: header
X-Hub-Signature-256, prefixsha256=. - A sender's own scheme. Over the API or in the YAML view, a
providersuch asgithuborslackchecks that sender's scheme. Slack signs the time of sending too, so an old delivery replayed later is refused. - Where it applies. A condition on the request path, as above, limits the check to the path that receives webhooks, such as
/webhooks/github. - What you see. With Traffic Capture on, refused deliveries show in the Traffic Inspector with their headers. They don't count toward your usage.
- The secret stays secret. After you save it, the field shows Saved secret — type to replace, and the API answers
****in its place.
Get started
- In the dashboard, go to Gateway → Endpoints, open the endpoint and its Traffic Policy tab.
- Next to on_http_request, click Add Rule and choose Verify Webhook.
- Fill in the signature header, the secret, the algorithm and the prefix, add a condition if only one path receives webhooks, and click Add Rule.
- Send a test delivery from the sender and find it in Observability → Traffic Inspector.
- Read the docs: Traffic policy rules and the rule's settings in the API.