Developers & API

Verify a HAWI webhook

Verify the signature over the unmodified body and timestamp, enforce the replay window and deduplicate the event ID.

HAWI signs webhook deliveries with a separate webhook secret. Verify the signature using the raw request body before parsing, reject stale timestamps and store processed event IDs to make handling idempotent. Never reuse OAuth client secrets for webhook verification. Delivery retries preserve the event identity while each attempt has its own delivery identity.

Audience: developer
Updated: 2026-08-24

Create a HAWI developer appEnroll as a developer, create or join a developer organization, then create an app owned by that organization.
Use HAWI OAuth authorization code flowRegister an exact redirect URL, use state and PKCE where applicable, exchange the one-time code, then rotate refresh tokens.
API errors, request IDs and rate limitsUse the structured error and request ID; respect per-app, account and endpoint rate limits.

Verify a HAWI webhook

Related guides