https://github.com/standard-webhooks/standard-webhooks Skip to content Toggle navigation Sign up * Product + Actions Automate any workflow + Packages Host and manage packages + Security Find and fix vulnerabilities + Codespaces Instant dev environments + Copilot Write better code with AI + Code review Manage code changes + Issues Plan and track work + Discussions Collaborate outside of code Explore + All features + Documentation + GitHub Skills + Blog * Solutions For + Enterprise + Teams + Startups + Education By Solution + CI/CD & Automation + DevOps + DevSecOps Resources + Learning Pathways + White papers, Ebooks, Webinars + Customer Stories + Partners * Open Source + GitHub Sponsors Fund open source developers + The ReadME Project GitHub community articles Repositories + Topics + Trending + Collections * Pricing Search or jump to... Search code, repositories, users, issues, pull requests... Search [ ] Clear Search syntax tips Provide feedback We read every piece of feedback, and take your input very seriously. [ ] [ ] Include my email address so I can be contacted Cancel Submit feedback Saved searches Use saved searches to filter your results more quickly Name [ ] Query [ ] To see all available qualifiers, see our documentation. Cancel Create saved search Sign in Sign up You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert {{ message }} standard-webhooks / standard-webhooks Public * Notifications * Fork 0 * Star 125 The Standard Webhooks specification www.standardwebhooks.com/ License Apache-2.0 license 125 stars 0 forks Activity Star Notifications * Code * Issues 9 * Pull requests 1 * Actions * Projects 0 * Security * Insights Additional navigation options * Code * Issues * Pull requests * Actions * Projects * Security * Insights standard-webhooks/standard-webhooks This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. main Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags Name already in use A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch? Cancel Create 3 branches 0 tags Code * Local * Codespaces * Clone HTTPS GitHub CLI [https://github.com/s] Use Git or checkout with SVN using the web URL. [gh repo clone standa] Work fast with our official CLI. Learn more about the CLI. * Open with GitHub Desktop * Download ZIP Sign In Required Please sign in to use Codespaces. Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Launching Xcode If nothing happens, download Xcode and try again. Launching Visual Studio Code Your codespace will open once ready. There was a problem preparing your codespace, please try again. Latest commit @hf hf spec: update signature schemes (#29) ... 5d3dfb0 Dec 7, 2023 spec: update signature schemes (#29) Updates the signature schemes wording to make the performance vs security considerations of symmetric and asymmetric schemes more apparent. Adds some more recommendations for each scheme. 5d3dfb0 Git stats * 24 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time .github/workflows assets libraries spec .gitignore CODE_OF_CONDUCT.md CONTRIBUTING.md LICENSE README.md View code [ ] Introduction What are Webhooks? Read the specification Reference implementations Technical steering committee Example ecosystem benefits of Standard Webhooks Related efforts README.md [brand] Open source tools and guidelines for sending webhooks easily, securely, and reliably Introduction Webhooks are becoming increasingly popular and are used by many of the world's top companies for sending events to users of their APIs. However, the ecosystem is fragmented, with each webhook provider using different implementations and varying quality. Even high quality implementations vary, making them inherently incompatible. This fragmentation is a pain for the providers and consumers, stifling innovation. For consumers, this means handling webhooks differently for every provider, relearning how to verify webhooks, and encountering gotchas with bespoke implementations. For providers, this means reinventing the wheel, redesigning for issues that have already been solved (security, forward compatibility, etc.). We propose a simple solution: standardize webhooks across the industry. This design document outlines our proposal, a set of strict webhook guidelines based on the existing industry best practices. We call it "Standard Webhooks". We believe "Standard Webhooks" can do for webhooks what JWT did for API authentication. Adopting a common protocol that is consistent and supported by different implementations will solve the above issues, and will enable new tools and innovations in webhook ecosystem. To achieve this, we have created an open source and community-driven set of tools and guidelines for sending webhooks. What are Webhooks? Webhooks are a common name for HTTP callbacks, and are a way for services to notify each other of events. Webhooks are part of a service's API, though you can think of them as a sort of a "reverse API". When a client wants to make a request to a service they make an API call, and when the service wants to notify the client of an event the service triggers a webhook ("a user has paid", "task has finished", etc.). Webhooks are server-to-server, in the sense that both the customer and the service in the above description, should be operating HTTP servers, one to receive the API calls and one to receive the webhooks.It's important to note that while webhooks usually co-exist with a traditional API, this is not a requirement, and some services send webhooks without offering a traditional API. Read the specification The latest draft specification can be found at spec/ standard-webhooks.md which tracks the latest commit to the master branch in this repository. The human-readable markdown file is the source of truth for the specification. Reference implementations There are reference implementations for the signature verification theme for a variety of languages, including: * Python * JavaScript/TypeScript * Java/Kotlin * Rust * Go * Ruby * PHP * C# Technical steering committee The Standard Webhooks initiative, the specification, and development of tooling is driven by the community and guided by the technical steering committee. Members (in alphabetical order): * Brian Cooksey (Zapier) * Ivan Gracia (Twilio) * Jorge Vivas (Lob) * Matthew McClure (Mux) * Nijiko Yonskai (ngrok) * Stojan Dimitrovski (Supabase) * Tom Hacohen (Svix) * Vincent Le Goff (Kong) Example ecosystem benefits of Standard Webhooks We believe "Standard Webhooks" can do to webhooks what JWT did to API authentication. Having a common protocol that is consistent will enable a variety of implementations to interoperate, reducing the development burden on webhook consumers and enabling new uses. Some of these benefits include: * API Gateway signature verification: signature verification is a common challenge for webhook consumers. Standard Webhooks makes it possible for verification to be implemented directly in the API gateway, easily solving verification for consumers. * Having a set of libraries for signing and verification make webhook verification easier for scenarios where API gateways can't be used. * Workflow automation tools (such as Zapier, Make, Workato, and tray.io) can implement the signature verification themselves to ensure a secure integration and save the need for integration builders to reinvent the wheel every time. * Standard Webhooks will enable building tools to automatically generate SDK for webhook consumers that in addition to verifying the signature can also validate the schemas (using JSON Schema, OpenAPI or AsyncAPI definitions). * Many more... Related efforts There are a few complementary or partially overlapping efforts to standardize asynchronous event communication. This specification is compatible with the rest of them, and can either reuse existing efforts or benefit further from collaboration with them. The most notable of such efforts are: * OpenAPI * AsyncAPI * CloudEvents * IETF HTTP Message Signatures * REST Hooks * Webhooks.fyi - a collection of useful webhooks resources (not a standardization effort). About The Standard Webhooks specification www.standardwebhooks.com/ Topics api http webhooks json webhook openapi specification standard callbacks asyncapi standard-webhooks Resources Readme License Apache-2.0 license Code of conduct Code of conduct Activity Stars 125 stars Watchers 9 watching Forks 0 forks Report repository Releases No releases published Packages 0 No packages published Contributors 10 * * * * * * * * * * Languages * C# 13.2% * Java 13.0% * PHP 12.5% * Python 12.5% * Ruby 12.5% * TypeScript 11.5% * Other 24.8% Footer (c) 2023 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact * You can't perform that action at this time.