Skip to main content

Register a webhook

POST 
/webhooks

Registers a webhook URL to receive notifications for all DAOs. On first registration, returns a one-time HMAC secret used to verify delivery signatures — it is never shown again, so store it immediately. Re-registering an already-active webhook returns success without a secret.

Deliveries are signed with HMAC-SHA256: HMAC-SHA256(${timestamp}.${rawBody}, secret), sent as the X-Webhook-Timestamp header (unix seconds) and the X-Webhook-Signature-V2 header (raw hex digest). Receivers should recompute the signature and compare it using a timing-safe comparison (crypto.timingSafeEqual), and reject requests where the timestamp is more than 5 minutes old to prevent replay attacks.

Request​

Responses​

Default Response