Webhook management

Register

1. Open Applications and select an existing application.
2. Open Webhooks and click the register-endpoint action.
3. Enter a publicly reachable HTTPS URL. Separate subscribed event names with spaces or commas; description is optional. Obtain event names from your business service's contract.
4. Immediately copy the original signing_secret shown once and store it in the receiver's secure configuration.
5. Configure the receiver with the official SDK examples in signature verification.

Rotate

Use the rotate-secret action on the endpoint card, confirm, save the new secret and update the receiver. Old secrets are immediately replaced for new deliveries; there is no 24-hour dual-signing window. Receivers may temporarily accept both original secrets for in-flight requests, then remove the old secret after migration.

Delete and capability boundaries

Delete removes the endpoint; verify it is no longer needed first. This page supports register, rotate and delete. It has no Deliveries, Retry, Send test event or Pause queue controls. A subscription configuration is not proof of an actual event delivery.

The current protocol verifies raw body bytes, without replay prevention or event-header authentication. See Webhooks.