Stayntouch webhooks now include an HMAC-SHA256 signature in the request header, allowing partners to verify that webhook payloads originate from Stayntouch and have not been tampered with. The signature is generated at chain level using a secret key.

Signature validation is optional. Existing integrations that do not implement signature verification will continue to receive webhooks without interruption. Partners who wish to enable validation can do so by using the shared secret key to verify the signature against the incoming payload.

All webhook transmissions occur over HTTPS. Full documentation on how to implement signature verification is available in the Connect API developer documentation here: Stayntouch: Webhook Signatue Verification Guide