Skip to main content

​
Rotate Secrets and Harden Webhook Receivers

​
Rotation workflow

  1. Create new secret in Linquid.
  2. Deploy receiver update supporting new secret.
  3. Verify signature validation with test delivery.
  4. Disable old secret after successful cutover.

​
Receiver hardening

  • enforce signature verification
  • enforce timestamp freshness window
  • implement idempotency store for replay/retry handling
  • return deterministic HTTP status codes

​
Webhook reliability checklist

  • Receiver verifies signature and timestamp.
  • Receiver is idempotent for retries.
  • Error responses are explicit (4xx for validation, 5xx for transient errors).
  • Delivery failures are monitored and routed to owner/on-call.
  • /help/integrations/set-up-webhooks-and-automation
  • /api-reference/webhooks/deliveries-testing-and-automation