Supported Providers

Webhook Watchtower has built-in presets for the most common providers. Selecting a preset when creating a source configures the correct signature algorithm automatically and enables duplicate event detection using the provider's own event ID headers.

Stripe

Signature header: Stripe-Signature
Algorithm: HMAC-SHA256 with timestamp prefix
Duplicate detection: Stripe event ID (evt_xxx) extracted from the request body

Stripe signs webhooks using a timestamp-prefixed format. The signed payload is {timestamp}.{body}, and the result is placed in the Stripe-Signature header alongside the timestamp (t=...) and one or more signatures (v1=...). Watchtower constructs the same signed string before comparing. This prevents replay attacks using old signatures.

Stripe test mode and live mode use different signing secrets. Create one source for each to keep events separate.

What the Stripe preset does:

Selects the correct timestamp-prefixed HMAC algorithm
Pre-fills the signing secret label as "Webhook signing secret" (whsec_... format)
Defaults "reject invalid signatures" to on (recommended for production)

Finding your Stripe signing secret:
Stripe dashboard → Developers → Webhooks → your endpoint → Signing secret → Reveal.

GitHub

Signature header: X-Hub-Signature-256
Algorithm: HMAC-SHA256, hex-encoded with sha256= prefix
Duplicate detection: X-GitHub-Delivery header (UUID unique per delivery)

GitHub puts the delivery UUID in the X-GitHub-Delivery header on every request. This means Watchtower can detect when GitHub re-delivers the same event (e.g. after a timeout) without forwarding it to your destinations a second time.

You can configure webhooks at the repository level (one repository) or organisation level (all repositories in the organisation).

What the GitHub preset does:

Selects the sha256= prefixed hex HMAC algorithm
Defaults "reject invalid signatures" to on

Finding your GitHub webhook secret:
Repository or organisation → Settings → Webhooks → your webhook → you set this secret yourself when creating the webhook in GitHub.

Shopify

Signature header: X-Shopify-Hmac-SHA256
Algorithm: HMAC-SHA256, base64-encoded
Duplicate detection: X-Shopify-Webhook-Id header (UUID unique per delivery)

Shopify uses a single shared secret for all webhooks from your store, derived from your app's API secret key. Unlike Stripe and GitHub, Shopify requires a separate webhook registration per event topic (e.g. orders/create, customers/update). All of them can point at the same Watchtower ingest URL.

What the Shopify preset does:

Selects the base64-encoded HMAC algorithm (Shopify's non-standard encoding)
Defaults "reject invalid signatures" to on

Finding your Shopify webhook secret:
Shopify admin → Settings → Apps and sales channels → Develop apps → your app → API credentials → API secret key.

Custom (HMAC-SHA256)

Signature header: configured per-source
Algorithm: HMAC-SHA256, hex-encoded
Duplicate detection: body hash within a 24-hour window

Use the Custom preset for internal services, third-party providers not in the list above, or any source that signs with standard hex-encoded HMAC-SHA256. Verification is optional. You can receive and store events without a signing secret and add one later.

Custom sources use body hash deduplication: if the same raw payload arrives from the same source within 24 hours, the second arrival is stored as a duplicate and not forwarded. This covers most retry scenarios without producing false positives on legitimate repeated payloads.

Duplicate event detection

All providers benefit from duplicate detection. The mechanism differs by what the provider sends:

Provider	Dedup signal	Window
Stripe	`evt_xxx` from body	Unlimited (exact match)
GitHub	`X-GitHub-Delivery` header	Unlimited (exact match)
Shopify	`X-Shopify-Webhook-Id` header	Unlimited (exact match)
Custom	SHA-256 body hash	24 hours

When a duplicate is detected:

The event is stored with a Duplicate label and a link to the original
Delivery to destinations is skipped
The event does not count toward your monthly usage

This saves delivery quota and prevents your downstream services from processing the same event twice.

Requesting a new provider

If you use a provider not listed here and it doesn't use standard HMAC-SHA256, contact us and we'll add a preset. Include the signature header name and a link to the provider's webhook documentation.