API & webhooks
Verify webhook signatures (coming soon)
Planned for Qubed: signed webhook deliveries you can verify with HMAC-SHA256. Webhooks aren't available yet; this page describes the planned design.
Coming soon — this feature isn't available yet. This page describes the planned design.
See the changelogWebhooks aren't available in Qubed yet, so there's nothing to verify today. This page describes how signature checks will work.
The plan
Each delivery will include a signature header, an HMAC-SHA256 of the timestamp and raw request body, made with a signing secret unique to your endpoint. Your server recomputes the signature with the same secret and compares the two.
Two habits will matter: compare signatures with a constant-time function (in Node, crypto.timingSafeEqual), never ===, and reject deliveries whose timestamp is more than a few minutes old to block replays.
What to do today
Read Subscriber webhooks for the overall plan, see how the referral waitlist works today, use CSV export in the meantime, and follow the changelog. Plans are on pricing.
Try it on a real page
Free forever · no card · every template included