Usage Example

POST /api/v1/webhooks
{
  "url": "https://your-server.com/webhooks/propstreet",
  "events": ["contact.created", "contact.updated", "contact.deleted"],
  "name": "CRM Sync Webhook"
}

Important

• The secret is only returned once during creation. Store it securely.
• The secret uses the whsec_ prefix followed by base64-encoded key material.
• The URL must be HTTPS.
• Use the secret to verify webhook signatures per the Standard Webhooks spec.

Signature Verification (Python example)

import hmac, hashlib, base64

def verify_signature(payload, msg_id, timestamp, signature, secret):
    # Decode secret (strip whsec_ prefix, base64-decode)
    key = base64.b64decode(secret[6:] if secret.startswith('whsec_') else secret)
    # Construct signed payload: {msg_id}.{timestamp}.{payload}
    signed = f"{msg_id}.{timestamp}.{payload}"
    computed = base64.b64encode(hmac.new(key, signed.encode(), hashlib.sha256).digest()).decode()
    expected = signature.split(',')[1]  # Parse v1,{base64} format
    return hmac.compare_digest(computed, expected)

See the Webhooks Guide for full documentation.