Optional signature validation
Source configuration and an event’s verification result are different facts.
Configure the mode
New webhooks are active with validation off by default. Turning Verify signature on reveals a searchable provider picker and its configuration fields. Search by name or alias, choose an available profile and save its configuration together with the mode.
Use the provider directory to check the exact signature scheme, authenticated fields, configuration and official documentation. Some profiles authenticate selected fields rather than the entire payload; a valid result applies only to that scope.
Turning validation off keeps the provider and stored secret dormant. It does not pause the source, remove its history or turn an existing source into Generic. Provider metadata extraction may still apply.
Read the event result
A secret-configured badge does not prove any event valid. Later edits do not rewrite historical signature results. Existing sources with missing keys or unsupported providers must not be mistaken for configured validation.
- Valid: the validator accepted the signature at receipt.
- Invalid: a validator ran and rejected it, with a recorded reason.
- Not checked: no verified result; for example verification_disabled, missing configuration or unsupported provider.
Capture and delivery
A failed or unverified signature can still be captured. With async enabled its content is retained for the same fixed 30-day period, but validation-on deliveries require a valid recorded signature. Invalid original events cannot be replayed later by replacing a secret.
With current validation off, outbound delivery omits incoming provider signature headers. With it on, replay requires a valid original result and the same provider. Acklane does not re-sign old bodies; a receiver may reject a stale timestamp.
Safe edits and rotation
Save mode/provider/key atomically. Edits use a configuration revision; a stale draft receives 409 and must be refreshed before confirming again. An unchanged key may be reused for the same provider; changing provider while enabling verification requires a new key.
Secret rotation is available only with validation on and a supported provider. The signing secret is never returned by ordinary reads.