Secure Webhook Endpoints with Auth Validation
Add industry-standard authentication to any Requex endpoint. Reject unauthorised callers, log every attempt — including failures — and forward only valid requests downstream.
Short answer: In Requex Settings → Auth, choose your method (HMAC, Bearer, API key, Basic, or Custom), paste your secret, and save. Requex now validates every inbound request. Failed attempts are logged with the label auth_failed so you can audit them without losing the data.
Supported Auth Methods
| Method | How it works | Use with |
|---|---|---|
| Bearer | Checks Authorization: Bearer <token> header | Internal APIs, custom services |
| HMAC | Computes HMAC(secret, rawBody) and compares signature header | Stripe, GitHub, Shopify |
| API Key | Reads a named header or query param, compares to expected value | Any service with API key auth |
| Basic | Decodes Authorization: Basic base64, compares username + password | Legacy services, simple setups |
| Custom | Reads any header, query param, or body dot-path | Non-standard auth schemes |
HMAC Configuration — Stripe Example
Stripe signs every webhook with a HMAC-SHA256 signature in the Stripe-Signature header. To validate it in Requex:
| Field | Value |
|---|---|
| Auth method | HMAC |
| Algorithm | sha256 |
| Signature header | Stripe-Signature |
| Signature prefix | v1= |
| Secret | whsec_... (from Stripe Dashboard) |
Requex captures the raw request body before JSON parsing — required for HMAC verification to work correctly. The raw bytes are used as the HMAC message, matching how Stripe computes the signature on their end.
What Happens on Auth Failure
When a request fails auth, Requex:
- 1. Saves the full request to your log with label
auth_failed - 2. Emits a real-time Socket.IO event so you see it live in the dashboard
- 3. Optionally adds a
WWW-Authenticateheader (if simulateChallenge is on) - 4. Returns 401 or 403 to the caller
- 5. Does not trigger forwarding rules — invalid requests don't reach your downstream services
Add auth to your webhook in 2 minutes
Free, no signup. Open Requex, configure auth, and you're protected.
Open Requex →Related use cases
Start Testing Webhooks Now
Generate your unique URL and test webhooks instantly. Free, no signup.
Open Webhook Tester →