Webhooks

Set webhook HMAC secret

Configure HMAC signing for webhook payload verification.

When enabled, all webhooks will include:

  • X-Handoff-Signature: HMAC-SHA256 signature (format: sha256=<hex>)
  • X-Handoff-Timestamp: ISO 8601 timestamp used in signature

Verification:

signature = HMAC-SHA256(timestamp + "." + payload, secret)

Security:

  • Secret is stored securely encrypted
  • Use a cryptographically random string of at least 32 characters
put/v1/webhook/hmac

Request

  • Base URL: https://api.handoff.ai
  • URL: https://api.handoff.ai/v1/webhook/hmac
  • Auth: HTTP bearer

Request body

secretstring required

HMAC secret for signing webhook payloads (minimum 32 characters)

Example request

{
  "secret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Response

HMAC secret configured successfully

enabledboolean required

Whether HMAC signing is enabled for webhooks

algorithmstring required

HMAC algorithm used for signing

headerNamestring required

HTTP header containing the signature

timestampHeaderNamestring required

HTTP header containing the timestamp

Example response

{
  "enabled": true,
  "algorithm": "sha256",
  "headerName": "X-Handoff-Signature",
  "timestampHeaderName": "X-Handoff-Timestamp"
}

Changes

No recorded changes to this operation across all 1 revision of this API.