Start here · Step 6

Configure signed webhooks

Receive consent and identity-access lifecycle changes reliably without trusting unsigned or replayed requests.

Create the endpoint

Register a dedicated HTTPS endpoint and store the signing secret only in your backend secret manager. Subscribe to the minimum event types your application can process.

Verify every delivery

• Read the raw request body before JSON parsing.
• Verify the signature using the active webhook secret.
• Reject timestamps outside the accepted tolerance.
• Store the event ID and ignore duplicate delivery attempts.
• Return a successful response only after durable acceptance.

Retries and rotation

Processing must be idempotent because deliveries can be retried. Rotation replaces the signing secret immediately. Update your endpoint's stored secret as part of the rotation operation and use the new secret for every subsequent delivery.

See the Webhook reference for headers, signature construction, event types, and retry behaviour.