Webhooks Integration
Send and receive HTTP webhooks for bi-directional integration with external systems.
Capabilities
This integration enables workers to:
- Receive inbound HTTP POST webhooks with automatic task creation
- Send outbound HTTP requests to external APIs
- HMAC-SHA256 signature verification for inbound webhooks
- Multiple authentication modes (bearer token, API key, basic auth)
- SSRF protection for outbound requests
- Idempotency support to prevent duplicate processing
- Configurable allowed hosts for outbound security
- Multi-instance support per organization
Setup
Follow these steps to connect Webhooks:
- Navigate to Integrations and click 'Add Webhook'
- Enter a display name for your webhook connection
- Configure inbound authentication (signature, API key, or none)
- Optionally enable outbound webhooks with base URL and auth settings
- Copy the unique inbound endpoint URL for your external systems
- Store any generated signing secrets securely
Security
- Inbound webhooks use unique path tokens that are cryptographically random
- HMAC-SHA256 signatures use constant-time comparison to prevent timing attacks
- All credentials (signing secrets, API keys, passwords) are encrypted with AES-256-GCM
- Outbound webhooks include SSRF protection blocking private IP ranges
- Request signing available for outbound webhooks (X-CW-Signature header)
- Rate limiting and timeout protection for all webhook operations
Credential Storage
All integration credentials are encrypted at rest using AES-256-GCM encryption. OAuth tokens are automatically refreshed when needed.
Supported Roles
The following roles can use this integration by default: