Connect a signed webhook

A signed webhook sends a minimized Premely event envelope to your HTTPS endpoint. Each delivery includes a signature you can verify with the signing secret created for that destination.

Use it when your own backend, internal tool or custom workflow needs to react to a Premely event without routing it through a provider-specific automation service.

1. 1

   Open Automation destinations

   Open Site settings, choose Connections, then choose Automation destinations for the selected site.

   Product screenshot placeholder

   Site settings - Automation destinations

   Capture focus: Provider, endpoint and events

   1Provider2Endpoint3Events

2. 2

   Choose Signed webhook

   Choose Signed webhook and enter the HTTPS endpoint your team controls. Use the endpoint for one clear workflow so the connection stays easy to maintain.

3. 3

   Select only useful events

   Choose the Premely events that have a real next action. For example, send alert.triggered.v1 to an incident workflow or export.completed.v1 to a controlled data workflow.

4. 4

   Save and store the signing secret

   Save the destination and copy the signing secret while it is visible. Store it in the secret manager or deployment environment used by the receiving endpoint.

   Product screenshot placeholder

   Automation destinations - Signed webhook

   Capture focus: HTTPS endpoint, selected events and one-time secret

   1Webhook URL2Events3Signing secret

5. 5

   Send a test before relying on it

   Send a test from Premely, verify its signature and confirm that the endpoint returns a successful response. Pause the destination while you change the receiver, then test it again before resuming.

Verify the x-premely-signature header against the raw request bytes before your application trusts or parses the event body.

import { createHmac, timingSafeEqual } from "node:crypto"

export function isPremelySignatureValid(
  rawBody: Buffer,
  header: string | undefined,
  signingSecret: string,
) {
  const supplied = header?.match(/^v1=([a-f0-9]{64})$/)?.[1]
  if (!supplied) return false

  const expected = createHmac("sha256", signingSecret)
    .update(rawBody)
    .digest("hex")

  return timingSafeEqual(
    Buffer.from(supplied, "hex"),
    Buffer.from(expected, "hex"),
  )
}