3 ms·
At FastComments we send an your API token in the webhook request, and if your API doesn't return a 401 with an invalid token the integration won't activate.
by winrid 6y ago
At FastComments we send an your API token in the webhook request, and if your API doesn't return a 401 with an invalid token the integration won't activate.
- chrismorgan 6y agoI can see why you might do that, but it seems mildly hostile to me and would have broken things for me on at least one or two occasions. I know I’ve set up very simple hook arrangements before where I don’t care about authentication, at least in part because the URL is secret and it’s probably just about dumping the hook call contents for now anyway. But at the same time, perhaps doing this would solve more problems than it creates.
- winrid 6y agoIt's not hostile. It's ensuring you properly authenticate the request, and that you own the target endpoint. :)