Signing webhook deliveries

Every outbound webhook delivery is signed with HMAC-SHA256. A webhook saved without a secret is given one, shown once; a webhook with no secret is shown as Unsigned — no secret set and its deliveries are not sent until one is set.

• Platform › Events & Webhooks › Webhooks › New: a webhook saved without a signing secret (or saved again as active without one) is given a strong one, shown to you once, with a copy button. Copy it to the receiver then; it is never shown again.
• Set signing secret on a webhook sets or replaces it: type one of at least 32 characters, or leave it blank to generate one and see it once. A shorter one is refused.
• HMAC-SHA256 is the only signature offered for outbound webhooks.
• Webhooks and Webhook Deliveries have a Signing column. A webhook with no secret reads Unsigned — no secret set, and each of its deliveries is failed with "Not sent: no signing secret is set on this webhook" rather than sent unsigned. Set a secret (or save the webhook again while active) and deliveries go out signed.

A delivery that fails because the receiver’s name could not be looked up (a DNS failure) is retried up to the webhook’s retry limit, like a failed connection. A target the platform refuses outright (a private or metadata address, a scheme it does not call) still fails on the first attempt.