20 Oct 2026, 01:16 UTC · 1 question · ID 9cc85ad9eac7
Who asked
Profile
We don’t have a profile for this visitor.
Question 1
“How can I be sure a webhook really came from Hourglass?”
Answer
✕Not answered
The site never mentions webhooks, so it says nothing about how they are signed, which header carries the signature or how to verify it against an endpoint secret.
Who needs it: Developers and IT teams building integrations
What is missing
Webhooks are not mentioned anywhere on the site.
How webhook payloads are signed is not explained.
The header that carries the signature and how to check it against an endpoint secret are not described.
No link to developer documentation for verifying webhooks.
Where
New section on /products/data, placed after "Data your teams and agents can rely on".
Related sections
The tools in Data Hub · Data syncs · Two-way syncs, without custom code
Main topics
Available webhook events · How webhook payloads are signed · Verifying a signature with the endpoint secret · Retries and delivery · Link to developer documentation
What to do
Confirm with engineering how webhooks are signed, which header carries the signature, how secrets are issued and rotated, and whether replay protection exists.
Add the section with a short overview of signing and verification and a link to the developer documentation.
Done when: /products/data has a section explaining how Hourglass signs webhooks and how to verify a signature, with a link to the docs.
Who needs it: CTOs and IT or security reviewers checking a vendor
What is missing
The security controls do not mention signed webhooks or how recipients can confirm a request came from Hourglass.
Where
Update this section: add a card beside "Encryption" and "Single sign-on".
What to do
Confirm with the security team how webhook signing is described for reviewers.
Add the card with a link to the webhooks section on /products/data.
Done when: /security has a card on webhook signing that links to the verification details. Depends on: “Add a webhooks and API section to /products/data”
Answer full page
You can verify each webhook by checking its signature in the Hourglass-Signature header against your endpoint's secret. The docs article below walks through the steps.