Whin setting up webhooks with the Circuit Rest API, how can we ensure that the messages are legitimate? Is there some king of signature that would allow us to trust the message we receive?
Thanks
Whin setting up webhooks with the Circuit Rest API, how can we ensure that the messages are legitimate? Is there some king of signature that would allow us to trust the message we receive?
Thanks
I have no experience with the Circuit API, but looking through their meager docs, I don't see any information about the event requests they send. I would recommend registering a hook and inspecting an actual webhook request. Something like ngrok can be very useful.
Make sure you look through the HTTP headers for anything that looks like a signature you can use. Also doesn't look like they support HTTPS, so you won't be able to confirm the SSL certificate. You can of course also open a GitHub issue asking for additional documentation on these events as well.