Check that webhook requests really come from your assessment

Every request your assessment sends is signed. Your server can check the signature and reject anything that didn't come from your assessment.

1. 1
   Copy the signing secret

   In Webhooks → Signed webhooks, copy the assessment's Signing secret.
2. 2
   Verify each request

   Your server reads the X-MarketKloud-Signature header and follows the steps shown in the panel to check it against the secret. Accept the request only if they match.
3. 3
   Replace it if it leaks

   Replace… issues a new secret. Update your server at the same time.