Hacker News new | ask | show | jobs
by subomi 1284 days ago
If you specify one public key for all endpoints, It means all consumers can verify each other’s webhook data which is not what you want. You want each consumer to be able to verify only webhooks intended for them and fail otherwise.

We wrote a detailed guide on generating and rolling public key/secrets for your endpoints here [1]

[1] https://getconvoy.io/blog/generating-stripe-like-webhook-sig...