Webhooks

Generic HTTPS delivery, HMAC signed, retried on network failure. No secret values in payloads.

Last updated: 2026-09-20

Delivery

Webhooks are plain HTTPS POST requests to a URL you control. You can point them at your own server, Zapier, Make, or any receiver that accepts JSON.

Headers

X-Getmyenv-Event - the event name, for example secret.revoked.
X-Getmyenv-Delivery - a unique delivery id.
X-Getmyenv-Timestamp - the delivery timestamp in seconds since the Unix epoch.
X-Getmyenv-Signature - HMAC SHA-256 signature in the form v1=<hex>.

Retries

A delivery is retried up to 5 times on network errors, timeouts, 5xx responses, and 429. 2xx responses count as delivered. Other 4xx responses are recorded and not retried.

Delivery statuses: pending, delivered, failed.

Payload safety

No secret values

Webhook payloads never include a secretValue. Events carry metadata only. In particular, secret.requested is a notification that a request happened, not a delivery of the value.

Verify a signature (Node)

javascript
import crypto from "node:crypto";

export function verifyGetenvSignature({
  rawBody,
  timestamp,
  signature,
  secret,
}) {
  const expected =
    "v1=" +
    crypto
      .createHmac("sha256", secret)
      .update(`${timestamp}.${rawBody}`)
      .digest("hex");
  const a = Buffer.from(expected);
  const b = Buffer.from(signature);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Reproduce with curl

bash
# Print the signing input for a captured delivery
printf '%s.%s' "$X_GETMYENV_TIMESTAMP" "$RAW_BODY" \
  | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" -hex