CRM Webhook Signing

Outbound Webhooks

Outbound CRM webhooks use the endpoint secret configured in the Enterprise Hub.

Header

X-Crm-Signature

Algorithm

sha256

Verification

Hash the raw request body using the endpoint secret and compare the result with the signature header.

Inbound Testing

Use the Enterprise Hub inbound event form to simulate:

• payment confirmations
• email replies
• calendar updates
• contact sync events
• SSO callback events

Verification Sequence

1. Read the request body as raw bytes before JSON parsing.
2. Compute the SHA-256 signature with the endpoint secret.
3. Compare signatures with a timing-safe function.
4. Reject missing or invalid signatures before changing CRM data.
5. Record delivery ID, event type, attempt, response status, and processing result without storing the secret.

Delivery Behavior

Handlers should be idempotent because a provider may retry the same event. Return a success only after the event is safely accepted, process slow work on the queue, and route repeated failures to the Enterprise Hub for review and replay.