Skip to main content

Documentation Index

Fetch the complete documentation index at: https://supahooks.ar27111994.dev/llms.txt

Use this file to discover all available pages before exploring further.

Webhook URLs are public by default, which means anyone who discovers your endpoint URL could post arbitrary payloads to it. Signature verification solves this by checking a cryptographic signature that only your provider can produce. If the signature is missing or does not match, the actor rejects the request with a 401 response and records the failure in the captured event.

​
Supported providers

ProviderSignature headerAlgorithm
StripeStripe-SignatureHMAC-SHA256 with timestamp
ShopifyX-Shopify-Hmac-Sha256Base64 HMAC-SHA256
GitHubX-Hub-Signature-256sha256=<hex>
SlackX-Slack-Signaturev0=<hex> with timestamp
CustomConfigurableConfigurable

​
Configure signature verification

Signature verification is configured through the signatureVerification input object. The signing secret is stored separately in the signatureVerificationSecret field so it stays masked in the Apify UI.

​
Stripe

{
  "signatureVerificationSecret": "whsec_your_stripe_secret",
  "signatureVerification": {
    "provider": "stripe",
    "tolerance": 300
  }
}
tolerance sets the maximum age in seconds of the request timestamp before the actor treats it as a replay attack. The default is 300 seconds (5 minutes). Accepted range is 60–3600.

​
Shopify

{
  "signatureVerificationSecret": "your_shopify_signing_secret",
  "signatureVerification": {
    "provider": "shopify"
  }
}

​
GitHub

{
  "signatureVerificationSecret": "your_github_webhook_secret",
  "signatureVerification": {
    "provider": "github"
  }
}

​
Slack

{
  "signatureVerificationSecret": "your_slack_signing_secret",
  "signatureVerification": {
    "provider": "slack",
    "tolerance": 300
  }
}

​
Custom HMAC provider

Use provider: "custom" when your provider uses HMAC but is not one of the built-in presets. You must supply the header name, algorithm, and encoding. Optionally supply timestampKey for replay protection. 
{
  "signatureVerificationSecret": "your_custom_hmac_secret",
  "signatureVerification": {
    "provider": "custom",
    "headerName": "X-My-Signature",
    "timestampKey": "X-My-Timestamp",
    "algorithm": "sha256",
    "encoding": "hex",
    "tolerance": 300
  }
}
Custom fieldValuesDescription
headerNamestringThe request header that contains the signature
timestampKeystringThe request header that contains the timestamp (optional)
algorithmsha256, sha1HMAC algorithm; defaults to sha256
encodinghex, base64Signature encoding; defaults to hex

​
Signature result fields on captured events

Every captured event includes two fields that reflect the outcome of signature verification:
FieldTypeDescription
signatureValidbooleantrue if the signature matched, false if it failed, absent if verification was not configured
signatureProviderstringThe provider name, e.g. stripe, github
You can filter the /logs endpoint by these fields: 
# Find all events with invalid signatures
curl "https://<run-id>.runs.apify.net/logs?signatureValid=false" \
  -H "Authorization: Bearer your-key"

​
What happens on failure

When signature verification fails, the actor:
  1. Returns a 401 response to the sender
  2. Records the event with signatureValid: false
  3. Optionally sends an alert to Slack or Discord if signature_invalid is in your alertOn list

​
Alert on signature failures

Add "signature_invalid" to alertOn to get notified immediately when a request fails verification: 
{
  "alertOn": ["error", "5xx", "signature_invalid"],
  "alerts": {
    "slack": {
      "webhookUrl": "https://hooks.slack.com/services/T000/B000/XXXX"
    }
  }
}