Skip to content

feat(webhooks): expose webhook signing secret on creation#1149

Merged
daveearley merged 4 commits intoHiEventsDev:developfrom
ptaranat:feature/expose-webhook-signing-secret
Apr 7, 2026
Merged

feat(webhooks): expose webhook signing secret on creation#1149
daveearley merged 4 commits intoHiEventsDev:developfrom
ptaranat:feature/expose-webhook-signing-secret

Conversation

@ptaranat
Copy link
Copy Markdown
Contributor

@ptaranat ptaranat commented Apr 7, 2026

What changes I've made

  • Add WebhookResourceWithSecret resource that extends WebhookResource to include the secret field
  • Update both CreateWebhookAction and CreateOrganizerWebhookAction to use this new resource
  • Update both CreateWebhookModal and CreateOrganizerWebhookModal to display the signing secret after creation with a copy-to-clipboard button and a warning that it won't be shown again
  • Extract and compile translations for new UI strings

Why I've made these changes

Fixes #1136

The webhook signing secret is auto-generated on creation but never exposed to the user. This makes it impossible for webhook consumers on the hosted cloud platform to verify webhook signatures, defeating the purpose of the HMAC signing mechanism.

How I've tested these changes

  • Created webhooks at both event and organizer level. Confirmed the signing secret modal appears after creation with a copy button
  • Confirmed the secret is not returned on GET/list/edit endpoints
  • Verified end-to-end webhook signature verification against a live staging receiver using the copied secret
  • Backend unit tests pass (php artisan test --testsuite=Unit)
  • No new TypeScript errors (tsc --noEmit)
chrome_NykPkqJp2g

Checklist

  • I have read the contributing guidelines.
  • My code follows the coding standards of the project.
  • I have tested my changes, and they work as expected.
  • I understand that this PR will be closed if I do not follow the contributor guidelines and if this PR template is left unedited.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 7, 2026

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@ptaranat
Copy link
Copy Markdown
Contributor Author

ptaranat commented Apr 7, 2026

I have read the CLA Document and I hereby sign the CLA

@ptaranat ptaranat force-pushed the feature/expose-webhook-signing-secret branch from 8350779 to f489f2d Compare April 7, 2026 16:27
@ptaranat ptaranat marked this pull request as ready for review April 7, 2026 16:29
@ptaranat ptaranat changed the title Feature/expose webhook signing secret Expose webhook signing secret on creation Apr 7, 2026
ptaranat added 4 commits April 7, 2026 12:39
Add WebhookResourceWithSecret that includes secret field.
Use this in both event and organizer webhook create actions.
Secret is only returned once on creation, excluded from other endpoints.
…eate

DIsplay secret in modal with warning that it won't be shown again.
Applies to both event and organizer webhook creation flows.
@ptaranat ptaranat force-pushed the feature/expose-webhook-signing-secret branch from f489f2d to 7937fe3 Compare April 7, 2026 16:40
@ptaranat ptaranat changed the title Expose webhook signing secret on creation feat(webhooks): expose webhook signing secret on creation Apr 7, 2026
@daveearley
Copy link
Copy Markdown
Contributor

Nice PR! Thank you.

Changes look good.

@daveearley daveearley merged commit 463c333 into HiEventsDev:develop Apr 7, 2026
1 check passed
@github-actions github-actions bot locked and limited conversation to collaborators Apr 7, 2026
@ptaranat ptaranat deleted the feature/expose-webhook-signing-secret branch April 7, 2026 21:18
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

🌟 Expose webhook signing secret in UI or API response on creation

2 participants