Skip to main content
When your app needs to hear about outside events — a Stripe payment succeeded, a GitHub push landed, a Slack command was typed — Creator gives it a public webhook endpoint with the hard part done properly: every delivery’s signature is verified before it counts. Unsigned or forged requests are rejected, so “anyone on the internet can POST fake events at my app” is designed out.

​
How it works for you

  1. The agent registers a webhook for your project and gets a public URL.
  2. You paste that URL into the vendor’s dashboard (Stripe → Webhooks, GitHub → webhook settings, Slack app config).
  3. For vendors with their own signing secret (Stripe, GitHub, Slack), the Infra tab shows Needs your secret — paste the vendor’s signing secret from their dashboard into the secure field. For generic senders, the platform mints the signing secret for you and the sender signs with it.
  4. Verified events are delivered to your app, each carrying a unique delivery ID so retries can’t be double-processed.
Alternatively, the vendor can point straight at a route in your app that verifies signatures itself — the agent picks the topology that fits the integration; either way, verification is never skipped.

​
Supported senders

​
When something goes wrong

Every delivery is recorded — received when, signature valid or not, delivered or still retrying. If your app was broken when an event arrived, fix the app and replay the delivery; nothing is lost. Ask the agent to show the delivery history or pending retries for any webhook.

​
Good to know

  • Webhook URLs are per-project and rate-limited.
  • Signing secrets live in your project’s secret store — never in code, never visible to the agent as plaintext.
  • Verification of a “reject the unsigned request” behavior is exactly the kind of promise the verification system checks — a handler that accepts anything fails the check.