Webhooks
Event endpoints for your account
Register HTTPS receivers, pick the events you care about, and let AffixIO push signed deliveries instead of polling. Each delivery is signed with a per-endpoint secret.
Register
Add endpoint
The signing secret is shown once. Store it in your receiver's environment.
Signing secret (shown once)
Inventory
Endpoints
Pause an endpoint to stop deliveries without losing its config. Rotate the secret if it leaks.
| Label | URL | Events | Last delivery | Status | |
|---|---|---|---|---|---|
| Loading endpoints… | |||||
Verify
Confirm a delivery is genuine
Read the headers
Each POST carries X-Affix-Event, X-Affix-Timestamp, X-Affix-Delivery-Id and X-Affix-Signature.
Recompute the MAC
The signature is hmac-sha256=HEX of HMAC-SHA256(secret, "{timestamp}.{raw_body}"). Compare in constant time.
Reject stale timestamps
Drop deliveries where the timestamp is more than five minutes from now to block replays. Deliveries retry up to three times.