Core · Who can call you, and what a leaked key can do.
Auth & secrets
Your webhook URL is public the moment it leaves your hands, and an API key is a password with superpowers. Two habits, verifying signatures and keeping keys server-side with minimal scope, prevent most disasters.
Try this
Run each experiment in the simulator above, then tick it off.
Key ideas
Verify every webhook
Payment providers sign webhooks with a shared secret (HMAC). Check the signature, or anyone who finds the URL can fake events.
Keys live on the server
Never in front-end code, a shared sheet or a screenshot. Use the platform's credential store or environment variables.
Least privilege, then rotate
Give each key only the permissions it needs, and rotate it the moment it might have leaked.
In your Pabbly workflows
Keep client credentials in Pabbly's app connections rather than pasting keys into step fields or sheets. For incoming payment webhooks, verify the signature in a Code step, or confirm the payment by fetching it from the provider's API before marking anything paid. Never trust an amount from a webhook you haven't verified.
Check yourself
0/2Get every question right to mark this lab done. Wrong answers let you try again.
Q1. Someone finds your payment webhook URL and posts a fake “payment captured” event. What stops it?
URLs leak through logs, screenshots and browser history. A signature can only be produced by someone holding the secret.
Q2. Where should an API key with write access live?
Anything a browser or a shared document can see is effectively public.
Lab complete
Marked done on this device. On to the next one.
Watch next
Searches for “api key security webhook signature” on the channels worth your time.