Verifying webhook requests

Sendr includes a secret header with every webhook request so you can verify the request genuinely came from Sendr and has not been tampered with.

How it works

When you create a webhook, Sendr generates a webhook secret for it. This secret is sent as a plain-text header on every request:

X-Webhook-Secret: YOUR_WEBHOOK_SECRET

Verifying on your server

On your server, check that the X-Webhook-Secret header matches the secret shown in your webhook settings. If the header is missing or does not match, reject the request.

Example in Node.js:

app.post('/webhook', (req, res) => {  const secret = req.headers['x-webhook-secret'];  if (secret !== process.env.SENDR_WEBHOOK_SECRET) {    return res.status(401).send('Unauthorized');  }  // process the event  res.status(200).send('OK');});

Finding your webhook secret

Your webhook secret is shown in Settings > Webhooks when you view the details of a specific webhook. Treat it like a password — do not expose it publicly.