diff --git a/app/views/docs/webhooks.phtml b/app/views/docs/webhooks.phtml index a18a58908..38dbe2f80 100644 --- a/app/views/docs/webhooks.phtml +++ b/app/views/docs/webhooks.phtml @@ -54,6 +54,13 @@ $events = $this->getParam('events', []); The ID of the project who owns the Webhook and API call. + + + X-Appwrite-Webhook-Signature +

version >= 0.15.0

+ + The HMAC-SHA1 signature of the payload. This is used to verify the authenticity of the payload. + User-Agent Each request made by Appwrite will be 'Appwrite-Server'. @@ -61,6 +68,87 @@ $events = $this->getParam('events', []); +

Verification

+ +

Webhooks can be verfied by using the X-Appwrite-Webhook-Signature header. This is the HMAC-SHA1 +signature of the payload. You can find the signature key in your webhooks properties in the dashboard. To generate this hash you append +the payload to the end of webhook URL (make sure there are no spaces in between) and then use the HMAC-SHA1 algorithm to generate the signature. + +After you've generated the signature, compare it to the "X-Appwrite-Webhook-Signature" header value. If they match, the payload is valid and you can trust it came from +your Appwrite instance.

+ + + + +

Events

A list of all currently available events you can hook to: