Webhook security

warning

Documentation is released in preview, is not final, and may be subject to changes. Sandbox and Production environments will be available soon.

Security

To ensure that the transmission of the information to your public endpoints comes from A-Cube, you can:

Configure a secret token

Configure a secret token in the event destination resource to ensure that the requests sent to your endpoints are authenticated.

• Choose authType = query to ask A-Cube to send the token as a query parameter.
• Choose authType = header to ask A-Cube to send the token as a header.
• Configure the token key authKey and the token value authToken in the event destination resource.

Examples

• In case you chose header as authType, X-Token as authKey and mysecret as authToken, A-Cube will send the token in the header X-Token: mysecret
• While in case you chose query as authType, token as authKey and mysecret as authToken, A-Cube will send the token in the query parameter ?token=mysecret

1. Securing a new webhook

POST /event-destinations

{
  "event": "invoice.outbound",
  "target": "https://your-domain.example/webhook",
  "delivery": "webhook",
  "authType": "header",
  "authKey": "X-Auth",
  "authToken": "asdfghjk"
}

2. Or securing an existing webhook

PUT /event-destinations/{eventId}

{
  "authType": "header",
  "authKey": "X-Auth",
  "authToken": "asdfghjk"
}

For both actions the response will look like:

{
  "eventId": "019ffeec-b9a7-7d3d-abac-2be663ec3de6",
  "event": "invoice.outbound",
  "delivery": "webhook",
  "target": "https://your-domain.example/webhook",
  "authType": "header",
  "authKey": "X-Auth",
  "authToken": "asdfghjk",
  "createdAt": "2026-08-14T06:19:14+00:00",
  "updatedAt": "2026-08-14T06:19:14+00:00"
}