Creating Webhooks

Creating a webhook

1. Go to Webhooks in the sidebar.

2. Click Create Webhook.

3. Fill in the fields:

   • Name (required): A descriptive name like “Production Server” or “Slack Notifications”.
   • URL (required): The HTTPS endpoint that will receive POST requests.
   • Events (required): Select which events trigger this webhook.

4. Click Create.

After creation, Tolinku generates a signing secret (prefixed with whsec_). Copy and store it securely. The signing secret is shown once and cannot be retrieved later.

Danger

Save the signing secret immediately. You need it to verify webhook signatures on your server. If you lose it, you can rotate the secret from the webhook management page (see below).

URL requirements

Your webhook URL must:

• Use HTTPS (HTTP is not accepted)
• Be publicly accessible from the internet
• Not point to localhost, 127.0.0.1, or private IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)
• Respond within 10 seconds

Tolinku validates the URL when you create or update the webhook. If it points to a private address, the request is rejected.

Editing a webhook

Click on a webhook to edit its name, URL, or event subscriptions. Changes take effect immediately. The signing secret does not change when you edit a webhook.

Enabling and disabling

Toggle the Active switch to temporarily stop deliveries without deleting the webhook. Inactive webhooks do not receive any events. Events that occur while the webhook is inactive are not queued or retroactively sent.

Rotating the signing secret

Click Rotate Secret on a webhook to generate a new signing secret. The old secret stops working immediately. A new whsec_ secret is displayed once for you to copy.

Rotate the secret if:

• The secret may have been exposed or leaked
• A team member with access to the secret has left
• Your security policy requires periodic rotation

After rotating, update the secret on your server before sending a test event to confirm verification still passes.

Caution

Rotating the secret invalidates the old one immediately. Any in-flight deliveries signed with the old secret will fail signature verification on your server. Update your server first if you want zero downtime.

Deleting a webhook

Click Delete to permanently remove a webhook and its delivery history.