Webhooks are now cryptographically signed so you can be certain each request genuinely came from Deftform and wasn't tampered with in transit.

What's new

• Every webhook now includes an X-Deftform-Signature-256 header — an HMAC-SHA256 signature of the raw request body, keyed with your workspace's webhook secret.
• You can now rotate your webhook secret anytime from Settings → Connections → Webhook.

Do I need to change anything?
No. The existing secret header is still sent, so current integrations keep working. When you're ready, we recommend switching to signature verification for stronger, tamper-proof security.

Read the guide: Verifying webhooks