Webhook security (i.e: hmac request signing)

Pebble Index
1

Hi, just got my index and setting my workflow. Super excited.

I find public http webhook not secure enough to use index triggered prompts as my main agents entry point which I want to make index to be that. But I want something more secure like request hmac signing which private key that I can validate requests coming from my index/phone.

2

We’d definitely accept a PR that adds this! GitHub - coredevices/mobileapp · GitHub

3

Ready: [New Feature] Webhook HMAC signing by mfyz · Pull Request #373 · coredevices/mobileapp · GitHub

Happy to answer any questions in the PR or here.

Already using it on production on my agent orchestrator back-end.

4

Definitely good to think about webhook security! Another, simpler alternative would be to use a capability URL (aka unguessable URL) as your webhook.

5

Not good enough though. Anyone tracing my network or my servers network might trace the unguessable URL. Only way to secure it to sign each request.