Added
Signed Webhook Deliveries
3 days ago
Webhook deliveries now include a Mamo-Signature header: an HMAC-SHA256 of the raw request body, hex-encoded, so you can verify a request came from Mamo and wasn't changed in transit. POST /webhooks now returns a signing_secret when it creates a new webhook. It is returned only once, never by list or update, or by a later POST /webhooks for the same URL, so store it securely. Webhooks created before this change have no secret and their deliveries stay unsigned; delete and re-create a webhook to start receiving signed deliveries. See Webhook delivery & retries for verification code in Node.js, Python and Ruby.