Sources

Every inbound webhook feed has its own source in Watchtower. Each source gets a unique ingest URL, which you configure in your provider's dashboard. When a webhook arrives, the event is logged, verified, and forwarded to your destinations.

One source per feed

The typical setup is one source per provider, per environment. For example:

• Stripe live: one source, one ingest URL configured in your Stripe live-mode webhook settings
• Stripe test: a second source, configured in Stripe test-mode webhook settings
• GitHub: a third source, configured in your repository or organisation webhook settings

Keeping environments separate means your test webhooks never appear in your live event log, and a problem in one source doesn't affect the others.

Creating a source

1. Go to Sources in your project.
2. Click Add source.
3. Choose a provider: Stripe, GitHub, Shopify, or Custom for anything else.
4. Give the source a name (auto-filled based on the provider, editable).
5. Paste the signing secret from your provider's dashboard. You can skip this and add it later.
6. Optionally enable Reject invalid signatures: returns 403 and discards events that fail verification. On by default for known providers, off for Custom.
7. Click Create source. Your ingest URL is generated immediately.

Copy the ingest URL and paste it as the webhook endpoint in your provider's dashboard.

Provider presets

Selecting a known provider configures the correct signature algorithm automatically and enables provider-specific duplicate detection. See Supported Providers for details on each one.

• Stripe: timestamp-prefixed HMAC-SHA256 (Stripe-Signature header), deduplication via Stripe event IDs (evt_xxx)
• GitHub: hex HMAC-SHA256 with sha256= prefix (X-Hub-Signature-256 header), deduplication via X-GitHub-Delivery UUID
• Shopify: base64-encoded HMAC-SHA256 (X-Shopify-Hmac-SHA256 header), deduplication via X-Shopify-Webhook-Id
• Custom: standard hex HMAC-SHA256, deduplication by body hash within 24 hours

Duplicate event detection

When the same event arrives more than once (provider retry, manual resend, or a timeout that caused a re-delivery), Watchtower detects it and skips delivery. The duplicate is stored with a Duplicate label linking back to the original, and it does not count toward your monthly usage. For known providers (Stripe, GitHub, Shopify), detection uses the provider's own event ID so it's exact and immediate. For custom sources, a body hash within a 24-hour window is used.

Data masking

Each source can be configured to hide sensitive values in the event viewer. When masking is on, auth headers (Authorization, Cookie, X-Api-Key) and provider signature headers are replaced with [redacted]. You can extend this with custom header names and dot-notation JSON field paths.

Masking is display-only. Raw payloads and headers are always preserved for forwarding. See Data masking for full details.

Signing secrets

The signing secret is the shared key used to verify that a request genuinely came from your provider. It's usually called "webhook secret", "signing key", or "endpoint secret" in your provider's dashboard.

Secrets are stored encrypted and never displayed in full after initial entry. If you need to rotate a secret, open the source's Verification settings and paste the new value. Verification uses the new secret immediately.

Disabling a source

Disabling a source pauses ingest. Events sent to the ingest URL while it's disabled return a 200 to the provider (so you don't lose the event on their side), but are not stored or forwarded. Re-enable the source to resume normal operation.

Deleting a source

Deleting a source removes the source configuration and its ingest URL. Stored events from that source are retained until they age out of your retention window. The ingest URL becomes invalid immediately, so configure a new one in your provider's dashboard if needed.