send.devWebhooks
Webhook Security
Learn how to verify webhook signatures, handle retries, and secure your webhook endpoints against attacks.
Want to be notified when this feature launches?Let us know
Planned Security Features
Signature Verification
Every webhook includes a signature header:
X-Send-Signature: sha256=abc123...Verify using your webhook secret:
import crypto from 'crypto';
function verifyWebhook(payload: string, signature: string, secret: string) {
const expected = crypto
.createHmac('sha256', secret)
.update(payload)
.digest('hex');
return `sha256=${expected}` === signature;
}Timestamp Validation
Reject webhooks older than 5 minutes:
const timestamp = parseInt(headers['x-send-timestamp']);
const now = Math.floor(Date.now() / 1000);
if (now - timestamp > 300) {
throw new Error('Webhook too old');
}Best Practices
- Always verify signatures
- Use HTTPS endpoints
- Respond quickly (< 5 seconds)
- Handle retries idempotently
- Log webhook events
Coming Soon
Contact us for early access.