All posts
Product
· 5 min read
Signing webhooks without a two-day rotation project
Rotating a signing secret used to mean coordinating with every customer. Here is how the grace window removes that coordination.
DO
Daniel Okafor
Developer Advocate
Every Hookline request carries a timestamp and an HMAC-SHA256 signature over the body. Verifying it takes four lines in any language. Rotating the secret behind it is where teams used to lose days.
The grace window
When you rotate a secret on an endpoint, Hookline signs each request twice for a window you choose, up to seven days. Receivers that still verify with the old secret keep working. Receivers that switch early keep working too. When the window closes we drop the old signature and the dashboard shows which endpoints never switched.
Bring your own secrets
If you already manage secrets elsewhere, set them per endpoint through the API. Rotation works the same way, and the audit log records who rotated what and when.
Ship your first webhook in five minutes.
Buy this template
$49