# Webhook signatures

> Every delivery carries the header Stackly-Signature: t=<unix>,v1=<hex>. Compute the HMAC-SHA256 of t, a dot, and the raw request body with your endpoint secret, and compare it to v1. Reject deliveries

Source: https://stacklyhq.xyz/docs/webhooks/signatures

## Getting started

- [Quickstart](https://stacklyhq.xyz/docs/getting-started/quickstart)
- [Create a workspace](https://stacklyhq.xyz/docs/getting-started/create-a-workspace)
- [Invite your team](https://stacklyhq.xyz/docs/getting-started/invite-your-team)
- [Import from CSV](https://stacklyhq.xyz/docs/getting-started/import-from-csv)

## Concepts

- [Workspaces and projects](https://stacklyhq.xyz/docs/concepts/workspaces-and-projects)
- [Tasks and subtasks](https://stacklyhq.xyz/docs/concepts/tasks-and-subtasks)
- [Statuses and workflows](https://stacklyhq.xyz/docs/concepts/statuses-and-workflows)
- [Labels and priorities](https://stacklyhq.xyz/docs/concepts/labels-and-priorities)
- [Roles and permissions](https://stacklyhq.xyz/docs/concepts/roles-and-permissions)

## API reference

- [API overview](https://stacklyhq.xyz/docs/api-reference/overview)
- [Authentication](https://stacklyhq.xyz/docs/api-reference/authentication)
- [Pagination](https://stacklyhq.xyz/docs/api-reference/pagination)
- [Errors](https://stacklyhq.xyz/docs/api-reference/errors)
- [Tasks API](https://stacklyhq.xyz/docs/api-reference/tasks)
- [Projects API](https://stacklyhq.xyz/docs/api-reference/projects)
- [Comments API](https://stacklyhq.xyz/docs/api-reference/comments)
- [Users API](https://stacklyhq.xyz/docs/api-reference/users)
- [Stackly API reference (complete)](https://stacklyhq.xyz/docs/api-reference/full)

## Webhooks

- [Webhooks overview](https://stacklyhq.xyz/docs/webhooks/overview)
- [Webhook events](https://stacklyhq.xyz/docs/webhooks/events)
- **Webhook signatures**
- [Webhook retries](https://stacklyhq.xyz/docs/webhooks/retries)

## SDKs

- [TypeScript SDK](https://stacklyhq.xyz/docs/sdks/typescript)
- [Python SDK](https://stacklyhq.xyz/docs/sdks/python)
- [Go SDK](https://stacklyhq.xyz/docs/sdks/go)

## Security

- [Security overview](https://stacklyhq.xyz/docs/security/overview)
- [Single sign-on](https://stacklyhq.xyz/docs/security/sso)
- [Data retention](https://stacklyhq.xyz/docs/security/data-retention)

## Limits

- [Plan limits](https://stacklyhq.xyz/docs/limits/plan-limits)
- [Rate limits](https://stacklyhq.xyz/docs/limits/rate-limits)

1. [Docs](https://stacklyhq.xyz/docs)
2. Webhooks
3. Webhook signatures

# Webhook signatures

Every delivery carries the header Stackly-Signature: t=<unix>,v1=<hex>. Compute the HMAC-SHA256 of t, a dot, and the raw request body with your endpoint secret, and compare it to v1. Reject deliveries where t is older than 5 minutes.

## Details

- A webhook endpoint must answer with a 2xx status within 10 seconds to count as delivered.
- Each endpoint has its own secret, shown once when you create it.
- Deliveries are at least once, so your handler should tolerate the same event arriving twice.
- The payload is JSON and its type field names the event.
- Use the delivery log in Settings to see the last attempts and the status your server returned.
- Webhook endpoints per workspace: Free 1, Pro 10, Business 50.
- You can pause an endpoint without deleting it, and missed events are not replayed after a pause.
- The Stackly API lets you create and delete endpoints, so integrations can set themselves up.
- A webhook endpoint must answer with a 2xx status within 10 seconds to count as delivered. (Webhook signatures, note 2.)
- Each endpoint has its own secret, shown once when you create it. (Webhook signatures, note 2.)
- Deliveries are at least once, so your handler should tolerate the same event arriving twice. (Webhook signatures, note 2.)
- The payload is JSON and its type field names the event. (Webhook signatures, note 2.)
- Use the delivery log in Settings to see the last attempts and the status your server returned. (Webhook signatures, note 2.)
- Webhook endpoints per workspace: Free 1, Pro 10, Business 50. (Webhook signatures, note 2.)
- You can pause an endpoint without deleting it, and missed events are not replayed after a pause. (Webhook signatures, note 2.)
- The Stackly API lets you create and delete endpoints, so integrations can set themselves up. (Webhook signatures, note 2.)

Every plan includes the Stackly API, so the steps on this page work on Free, Pro and Business.

## See also

- [Webhooks overview](https://stacklyhq.xyz/docs/webhooks/overview)
- [Security overview](https://stacklyhq.xyz/docs/security/overview)

Previous: [Webhook events](https://stacklyhq.xyz/docs/webhooks/events) | Next: [Webhook retries](https://stacklyhq.xyz/docs/webhooks/retries)