Inbound Verification Options

Why You Would Use This

Verification settings let you define what a valid inbound webhook looks like before HookBridge forwards it. This helps block spoofed or malformed traffic at ingest instead of discovering problems later in downstream systems.

Available Options

• verify_static_token: require a known token value in a header or query param.
• verify_hmac: require a valid HMAC signature header.
• hmac_signature_encoding: how the HMAC signature header is encoded, hex or base64. Defaults to hex. There is no auto-detect, so a signature in the wrong encoding is rejected.
• timestamp_header_name + timestamp_ttl_seconds: enforce timestamp freshness when verifying signed requests.
• verify_ip_allowlist: require sender IP to be in configured CIDR ranges.
• ingest_response_code: choose the 2xx code returned on successful ingest.
• signing_enabled: add HookBridge signatures on forwarded deliveries to your destination.

Console Workflow

1. Open Endpoints and switch to Inbound.
2. Open the endpoint you want to configure.
3. Enable only the verification modes your provider supports.
4. Enter required headers/secrets/CIDRs and save. When HMAC is on, pick Hex or Base64 to match how your provider encodes its signature.
5. Send a provider test webhook and confirm accepted vs rejected behavior.

API Workflow

API reference:

• Get inbound endpoint
• Update inbound endpoint

curl -X PATCH https://api.hookbridge.io/v1/inbound-endpoints/YOUR_INBOUND_ENDPOINT_ID \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "verify_hmac": true,
    "hmac_header_name": "X-Signature",
    "hmac_secret": "YOUR_PROVIDER_HMAC_SECRET",
    "timestamp_header_name": "X-Webhook-Timestamp",
    "timestamp_ttl_seconds": 300,
    "verify_ip_allowlist": true,
    "allowed_cidrs": ["203.0.113.0/24"],
    "ingest_response_code": 202
  }'

Shopify example

Shopify sends a base64-encoded signature in X-Shopify-Hmac-Sha256. Set hmac_signature_encoding to base64 and use your Shopify app’s client secret as hmac_secret.

curl -X PATCH https://api.hookbridge.io/v1/inbound-endpoints/YOUR_INBOUND_ENDPOINT_ID \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "verify_hmac": true,
    "hmac_header_name": "X-Shopify-Hmac-Sha256",
    "hmac_signature_encoding": "base64",
    "hmac_secret": "YOUR_SHOPIFY_APP_CLIENT_SECRET"
  }'