How to connect signed webhooks and verify their signature
Create a webhook in Metixon, save its signing secret, and verify every delivery on your server. Plus: pause it, rotate the secret, and delete it.
Connect signed webhooks, step by step
With a webhook, Metixon notifies your server whenever an event happens, signed so you know it's really from Metixon.
1New webhook: name, URL, and events
In Webhooks, click New webhook. Give it a name and the public URL of the server that receives it.
Under Events, list the ones you want, comma separated. Empty means all of them. Then click Create.
2Save the signing secret: it's only shown once
Its signing secret appears. Copy it to your server now: it's only shown this once.
With that secret, your server recalculates each delivery's signature and compares. If it doesn't match or is over five minutes old, it's rejected.
Endpoints shows the status and last delivery. A two hundred code means your server got it.
3Pause, Rotate the secret, and Delete
If your server goes down for maintenance, click Pause, then Activate when it's back.
Think the secret leaked? Click Rotate. A new one is generated and, again, shown once: update your server.
And delete any webhook you no longer use; the browser asks you to confirm.
Name, URL, and events; save the secret, verify the signature, and rotate it as needed.
Frequently asked questions
Where do I see the webhook's signing secret?
It appears only once, right when you create or rotate the webhook. Copy it to your server at that moment; afterward you'll only see its first few characters.
How do I verify that a delivery comes from Metixon?
Using the secret, your server recalculates each delivery's signature and compares it with the one it received. If they don't match or it's more than five minutes old, it rejects it.
What do I do if the secret leaked?
Click Rotate in the Endpoints table. A new one is generated, also shown only once, and you update it on your server.
