Configuring Sources

A Source is an ingestion configuration inside a Project. It owns an authentication method, a public locator, and a signing credential.

Create a Source

In the dashboard: Sources → Create Source. Choose:

Field	What to enter
Project	The Project that should filter this Source.
Name	A short label, up to 120 characters.
Authentication	Standard Webhooks, generic bearer, Stripe, or Shopify.
Provider secret	Required for Stripe and Shopify; generated by DeadHook for the other modes.

The Source page shows the complete ingestion URL and returns the signing secret once for DeadHook-generated credentials. Store it in a secret manager; it cannot be retrieved later, only rotated.

The ingestion locator is not a credential. Anyone who knows the URL can address the endpoint, but the request still has to pass signature or bearer authentication.

Authentication methods

Standard Webhooks

DeadHook verifies:

webhook-id: msg_...
webhook-timestamp: 1760000000
webhook-signature: v1,<base64 HMAC-SHA256>

The signed content is the exact bytes:

{webhook-id}.{webhook-timestamp}.{raw request body}

The HMAC key is the base64-decoded value after the whsec_ prefix. DeadHook accepts multiple space-separated signatures and checks the previous secret during rotation. Timestamp tolerance is 300 seconds.

The webhook-id becomes the authenticated upstream Event ID. It is required and is used for deduplication.

Generic bearer

Send:

Authorization: Bearer <source-secret>

The X-Event-ID header is optional; when present it becomes the upstream Event ID and deduplication key. Without it, each request is a new Event even if the bodies are byte-identical. Do not use body hashing as an event identity.

Stripe

Supply your Stripe endpoint secret when creating the Source. DeadHook verifies Stripe-Signature: t=<unix>,v1=<hex> over timestamp + "." + raw body, then reads the Event id from the verified JSON. Forged pre-verification IDs are never trusted.

Shopify

Supply the Shopify app secret. DeadHook verifies X-Shopify-Hmac-SHA256 as a base64 HMAC-SHA256 of the raw body and requires X-Shopify-Webhook-Id. Shopify has no timestamp in this signature; replay protection depends on the delivery ID and your Shopify configuration.

Rotate or disable a Source

• Rotate secret is available on the Source page. The old secret remains valid for a 24-hour overlap for DeadHook-issued credentials, then expires.
• Disable stops new authenticated ingestion. Existing Events and Deliveries continue.
• Changing a Source's authentication method in place is not supported; create a new Source and cut traffic over.

Operational limits

• Ingestion body limit is 256 KiB.
• Accepted content types: application/json, *+json, text/plain, and application/octet-stream.
• Each Source is subject to Organization Event quota and request rate limiting.
• Authentication failures return 401 with invalid_signature; missing required headers return 400; request-rate limiting returns 429 rate_limited with Retry-After; monthly accepted-Event quota exhaustion returns 409 plan_limit_reached.