Webhook Security
In a nutshell
Webhook security protects your integration from forged events and duplicate processing.Headers
Merchant webhook deliveries can include:| Header | Description |
|---|---|
x-nombasub-event | Event type. |
x-nombasub-webhook-id | Delivery ID. |
x-nombasub-tenant-id | Tenant ID. |
x-nombasub-timestamp | Event timestamp. |
x-nombasub-signature | Signature when signing is configured. |
Verification
When a signing secret is configured, verify the signature before processing the webhook. The signature is based on event type, webhook ID, tenant ID, timestamp, and your webhook secret.Best practices
- Use HTTPS webhook URLs.
- Return 2xx quickly.
- Process events asynchronously.
- Store processed webhook IDs to prevent duplicates.
- Treat webhook payloads as notifications; fetch fresh data when public read endpoints are available.