Webhooks

Signatures

Every delivery is signed so you can verify authenticity.

Headers

aegix-webhook-id
aegix-event-id
aegix-timestamp
aegix-signature

Signature scheme

signature = hex( HMAC-SHA256( secret, "<aegix-timestamp>.<rawBody>" ) )

Always verify against the exact raw body bytes. See the verification page for the reference implementation.

Secret handling

Webhook secrets are shown once at creation/rotation and encrypted at rest. Rotating a secret invalidates the old one immediately.