Signed alert webhooks

The per-alert webhooks of ChartDeck alerts are signed too - same signature header, same check, body unchanged.

The webhook you can put on a ChartDeck alert (in the alert dialog) now carries the same signature headers as API webhooks. The body is exactly what it was before, so receivers that ignore headers see no change.

The secret (whsec_cd_...) is one per account and is made at your first alert-webhook delivery; you find it in your account's notification settings. Rolling it makes a new secret and the old one stops signing at once, so update your receiver straight after. Verify exactly as on Verify signatures.

For the API's stronger delivery (8 retries over 24 hours, a delivery log, dedupe ids), subscribe an API webhook endpoint to alert.fired instead; the per-alert webhook keeps working beside it.