Skip to main content

Verifying authenticity

:::danger Webhook deliveries are not signed There is no HMAC header, no signature, and no shared secret on a delivery. Nothing in the request proves it came from Telebroad, so anyone who learns your webhook URL can POST a forged event to it. :::

Until signing ships, these are the controls available.

Treat the URL as a secret​

It is the closest thing to a credential this system has.

  • Make it unguessable — https://example.com/hooks/tb/8f2b1c94d7e34a1f, not https://example.com/telebroad.
  • Rotate it if it leaks: PATCH the subscription's url. Effective immediately, no coordination with us needed.

You can also carry your own token in it and reject requests without it — prefer a path segment over a query parameter, since query strings end up in proxy logs.

Confirm before you act​

A webhook is a hint that something happened; the API is the record of what did.

Never act on money, access, or destructive operations from a webhook alone. Fetch the call, message, or recording by the id in the payload first — a forged event cannot make the API lie.

IP allowlisting​

Deliveries come from Telebroad's egress addresses. Ask support for the current list. Confirm it before relying on it — it changes with infrastructure work, and a stale allowlist fails closed by silently dropping every event.

mTLS is not supported.