Flexport Webhook Integrity and Reconciliation

Overview

Authenticate before parsing. Flexport documents both SHA-1 and SHA-256 signatures, with SHA-256 recommended in X-Hub-Signature-256; compare against the raw UTF-8 body and treat webhook delivery as a notification that may require API reconciliation.

Prerequisites

• Unique receiver URL and high-entropy webhook secret
• Framework support for raw request bytes before JSON parsing
• Allowlisted slash/hash event types and idempotency store

Instructions

Step 1: Register deliberately

Configure the callback and secret in Flexport account Settings. Record the intended event types and owner.

Step 2: Capture raw bytes