Webhook Secret Best Practices: Length, Storage, and Zero-Downtime Rotation
How long a webhook secret should be, static tokens vs HMAC signatures, storing secrets in environment variables, and rotating them with zero downtime.
Tutorials
A collection of 28 issues
Why You Shouldn't Use an Online Webhook Secret Generator
Online secret generators ask you to trust someone else's server with a value whose whole point is secrecy. Use your terminal, or your own browser console, instead.
How to Generate a Webhook Secret (Copy-Paste Commands for Linux, macOS, Windows)
Copy-paste terminal commands to generate a cryptographically strong webhook secret on Linux, macOS, and Windows, with no installs, and how to use it in a self-hosted receiver.
How to Receive Webhooks from Mastodon (Self-Hosted, Step by Step)
Receive and verify Mastodon admin webhooks on your own server: X-Hub-Signature HMAC-SHA256 validation with source-confirmed facts, the auto-generated signing secret, Docker setup, and RabbitMQ routing, every command verified locally.
How to Receive Webhooks from Healthchecks (Self-Hosted, Step by Step)
Receive Healthchecks up/down alerts as webhooks on your own server: variable-templated bodies, secret header authentication, the private-IP setting, Docker setup, and RabbitMQ routing, verified against real check flips.
How to Receive Webhooks from OpenProject (Self-Hosted, Step by Step)
Receive and verify OpenProject webhooks on your own server: X-OP-Signature HMAC-SHA1 validation with source-confirmed facts, the SSRF allowlist, Docker setup, and RabbitMQ routing, every command verified locally.
How to Receive Webhooks from Cal.com (Self-Hosted, Step by Step)
Receive and verify Cal.com booking webhooks on your own server: X-Cal-Signature-256 HMAC-SHA256 validation from source-confirmed facts, Docker setup, and RabbitMQ routing, every command verified locally.
How to Receive Webhooks from changedetection.io (Self-Hosted, Step by Step)
Receive changedetection.io change notifications as webhooks: the Apprise json:// target with a secret header, Docker setup, and RabbitMQ routing, verified against a real page-change cycle.
How to Receive Webhooks from Paperless-ngx (Self-Hosted, Step by Step)
Receive paperless-ngx workflow webhooks on your own server: Jinja placeholders, secret header authentication, the PAPERLESS_URL tip, Docker setup, and RabbitMQ routing, verified against real document consumptions.
How to Receive Webhooks from Metabase Alerts (Self-Hosted, Step by Step)
Receive Metabase alert webhooks on your own server: Bearer authentication, the host-strategy SSRF setting, the empty-body test ping gotcha, Docker setup, and RabbitMQ routing, verified against a real Metabase alert.