Webhook

Set up delivery

1. 1

   Add an alert channel

   Open Settings → Alerts, choose Add Channel → Webhook and enter your receiver URL.

2. 2

   Set a signing secret

   Enter a secret and store the same value securely in your receiver. The signature header is only sent when a secret is configured.

3. 3

   Save and test

   Save and use Test. Handle alert.test as a test, incident.detected as a vendor incident alert and sdk.failures as an SDK failure alert. All three use a flat JSON body.

Verify the signature

import crypto from "node:crypto";

export function verifySignature(
  body: string,
  signature: string,
  secret: string,
): boolean {
  // Check the format before decoding untrusted header values.
  if (!/^[0-9a-f]{64}$/i.test(signature)) return false;
  const expected = crypto.createHmac("sha256", secret).update(body).digest();
  return crypto.timingSafeEqual(Buffer.from(signature, "hex"), expected);
}