CRM Webhook

Every request must carry an HMAC-SHA256 signature over the timestamp + body, plus a fresh timestamp within a 5 minute replay window. Unsigned requests are rejected with 401.

Webhook secret

Event type

Payload (JSON)

Tamper body after signing (should fail verification)

Response

Send a signed request to see the server response. Toggle the tamper box to watch the HMAC verification reject a modified body.