Endpoint Security

HTTPS Requirement

All webhook endpoints must use HTTPS with:

• TLS version 1.2 or higher
• Valid SSL certificate from a trusted Certificate Authority
• Certificate must match your endpoint domain
• Certificate must not be expired

IP Whitelisting

Add SCALAR's IP addresses to your firewall whitelist:

HMAC Signature Validation

Webhook authenticity is verified through HMAC-SHA256 signatures:

Signature Process

• SCALAR signs each request using your webhook secret
• Signature is included in the X-Webhook-Signature header
• Format: sha256=calculated_hash

Validation Implementation

Always validate signatures before processing events. Example logic:

1. Extract the signature from X-Webhook-Signature header
2. Read the raw request body
3. Calculate HMAC-SHA256 of body using your webhook secret
4. Compare calculated hash with provided signature
5. Reject request if signatures don't match