Handle sensitive webhook data safely
Webhook payloads and headers can contain personal data, authentication material, payment references, internal identifiers, and business records. Minimize what you send and control who can inspect or replay it.
Data that needs special care
- Authorization, cookie, API-key, and signature headers.
- Webhook signing secrets and bearer tokens.
- Personal contact, account, and customer information.
- Payment, order, subscription, and support records.
- Internal URLs, identifiers, and infrastructure metadata.
Safer capture practices
- Prefer provider test mode and synthetic data during development.
- Do not place secrets inside the JSON payload for convenience.
- Use the shortest retention period that satisfies the debugging need.
- Review a captured event before creating a public share link.
- Use a controlled target for replay and remove production credentials from test destinations.
Share-link behavior
Public debug links mask selected sensitive request headers, but the webhook payload remains visible to anyone who can use the active link. Review the payload, choose a short expiry, and revoke the link after use.
Incident response
- Revoke active share links.
- Rotate exposed provider secrets, tokens, and account credentials.
- Stop new delivery to the affected endpoint if necessary.
- Contact support with event identifiers, not full secrets.