Skip to content
Stackly
Log inStart free
  1. Docs
  2. Webhooks
  3. Webhook signatures

Webhook signatures

Every delivery carries the header Stackly-Signature: t=<unix>,v1=<hex>. Compute the HMAC-SHA256 of t, a dot, and the raw request body with your endpoint secret, and compare it to v1. Reject deliveries where t is older than 5 minutes.

Details

  • A webhook endpoint must answer with a 2xx status within 10 seconds to count as delivered.
  • Each endpoint has its own secret, shown once when you create it.
  • Deliveries are at least once, so your handler should tolerate the same event arriving twice.
  • The payload is JSON and its type field names the event.
  • Use the delivery log in Settings to see the last attempts and the status your server returned.
  • Webhook endpoints per workspace: Free 1, Pro 10, Business 50.
  • You can pause an endpoint without deleting it, and missed events are not replayed after a pause.
  • The Stackly API lets you create and delete endpoints, so integrations can set themselves up.
  • A webhook endpoint must answer with a 2xx status within 10 seconds to count as delivered. (Webhook signatures, note 2.)
  • Each endpoint has its own secret, shown once when you create it. (Webhook signatures, note 2.)
  • Deliveries are at least once, so your handler should tolerate the same event arriving twice. (Webhook signatures, note 2.)
  • The payload is JSON and its type field names the event. (Webhook signatures, note 2.)
  • Use the delivery log in Settings to see the last attempts and the status your server returned. (Webhook signatures, note 2.)
  • Webhook endpoints per workspace: Free 1, Pro 10, Business 50. (Webhook signatures, note 2.)
  • You can pause an endpoint without deleting it, and missed events are not replayed after a pause. (Webhook signatures, note 2.)
  • The Stackly API lets you create and delete endpoints, so integrations can set themselves up. (Webhook signatures, note 2.)

Every plan includes the Stackly API, so the steps on this page work on Free, Pro and Business.

See also

Previous: Webhook events | Next: Webhook retries