Are we asymmetric yet?

SaaS webhook signing schemes, ranked by verifiability without a shared secret.

11 / 40 asymmetric
Asymmetric — verifying webhooks requires no secret key material on the consumer.
Shared secret — verifying requires key material on the consumer (HMAC or static token); anyone with it can forge webhooks.
ProviderSchemeProof
Apple App Store
JWS / ES256docs ↗
AWS SNS
RSA-SHA256 (X.509 cert)docs ↗
Discord
Ed25519docs ↗
Google Play RTDN
OIDC JWT / RS256docs ↗
Jira
JWT RS256 (lifecycle) / HS256 (Connect)docs ↗
Microsoft Graph
JWS RS256 (validation token) + RSA-OAEP encrypted payloaddocs ↗
PayPal
RSA-SHA256 (rotating X.509 certs)docs ↗
Plaid
JWT / ES256docs ↗
SendGrid
ECDSA P-256docs ↗
Svix
Ed25519 (opt-in) / HMAC-SHA256 (default)docs ↗
Twilio
ECDSA P-256 (opt-in) / HMAC-SHA1 (default)docs ↗
Adyen
HMAC-SHA256docs ↗
Auth0
Bearer tokendocs ↗
Calendly
HMAC-SHA256docs ↗
Clerk
HMAC-SHA256 (Svix)docs ↗
Cloudflare
Static shared secretdocs ↗
Coinbase Commerce
HMAC-SHA256docs ↗
DocuSign
HMAC-SHA256docs ↗
GitHub
HMAC-SHA256docs ↗
GitLab
HMAC-SHA256 / X-Gitlab-Tokendocs ↗
HubSpot
HMAC-SHA256docs ↗
Intercom
HMAC-SHA1docs ↗
Linear
HMAC-SHA256docs ↗
Mailgun
HMAC-SHA256docs ↗
Mux
HMAC-SHA256docs ↗
Netlify
JWS HS256docs ↗
Notion
HMAC-SHA256docs ↗
Okta
Static header tokendocs ↗
Paddle
HMAC-SHA256docs ↗
Postmark
HTTP Basic Authdocs ↗
Replicate
HMAC-SHA256 (Svix)docs ↗
Resend
HMAC-SHA256 (Svix)docs ↗
Sentry
HMAC-SHA256docs ↗
Shopify
HMAC-SHA256docs ↗
Slack
HMAC-SHA256docs ↗
Square
HMAC-SHA256docs ↗
Stripe
HMAC-SHA256docs ↗
Vercel
HMAC-SHA1docs ↗
Zendesk
HMAC-SHA256docs ↗
Zoom
HMAC-SHA256docs ↗

Spotted a missing or wrong entry?

This list is open source. PRs and issues welcome.

Contribute on GitHub