Standard Webhooks signing for outbound destinations
Outbound webhook destinations can now emit Standard Webhooks signatures with receiver-supplied whsec_ secrets, stable retry ids, and fresh per-attempt timestamps.
Outbound webhook destinations can now use the Standard Webhooks signing format. Give Atoll the receiver's whsec_ secret and each request includes the headers your Standard Webhooks receiver expects, while the existing Atoll signatures continue to work.
Configure the receiver's key
Add Standard Webhooks signing when you create or edit a destination in Webhook Settings, or use the standard_webhooks field in the API. The receiver-supplied key is write-only, must use canonical standard Base64 after whsec_, and must decode to 24-64 bytes. Lists show only whether a key is configured.
Verify every request
Atoll sends webhook-id, webhook-timestamp, andwebhook-signature: v1,<base64>. The signature covers the exact raw body with deliveryId.timestamp.rawBody and HMAC-SHA256. Automatic retries keep the same delivery id and Idempotency-Key with a fresh timestamp and signature for each attempt. Manual redelivery creates a new logical id and key. A 2xx response proves receiver acceptance.
Existing delivery behavior stays available
Atoll's X-Atoll-* signature headers and Bearer authentication remain available. Standard Webhooks signing is additive, and queued deliveries keep their pinned destination configuration when a setting is changed.