Build on it / Webhooks and API keys
Events out, signed, and recorded on every try
Subscribe your systems to platform events, check each message’s signature, and see every delivery attempt — so you react to a claim status change rather than polling for it.
Most credential incidents are not stolen keys. They are keys that outlived the integration, the project or the person who created them.
The question this answers
How do we know a message really came from Waypoint?
Each message carries an X-Waypoint-Signature header: an HMAC-SHA256 of the body using that endpoint’s own secret. Your receiver computes the same and compares. A message whose signature does not match did not come from your Waypoint endpoint.
Managing what you have issued
Endpoints, keys, delivery
Choose The Events
claim.created, claim.status_changed, payment.issued, siu.referral_opened, quote.responded, policy.bound, and a test event.
Signed With Each Endpoint’s Secret
Up to 10 endpoints per organization, each with its own secret.
Retried, Then Marked Dead
Up to 5 attempts, retried after 1, 5, 30 and 60 minutes. A sweep runs every 10 minutes. After the last try the delivery is marked dead — not dropped silently.
Keys Are Inventoried
Up to 10 partner keys, each with its scopes and limits. A key is shown once and can be revoked.
Secrets Are Never Returned
Like every credential on the platform: once saved, not readable back from any screen.
Credential hygiene
The questions an audit will ask about keys
API credentials are where careful access control usually leaks, because they outlive the people and projects that created them.
Question
Answer
What Keys Exist?
Listed with their scopes, daily limit and burst guard
What Can It Reach?
Its scopes, and in enforce mode nothing else
How Do We Kill It?
Revoke it; marketplace app keys stop on the next request
Can We Read The Secret Again?
No. Shown once
Are Our Webhooks Arriving?
Every delivery is recorded, and dead ones are marked
What Do Messages Carry?
Identifiers, statuses and amounts only — read details through the API
Where we are honest
Delivery guarantees, stated plainly
Event delivery is genuinely hard, and vague promises here cause production incidents on your side rather than ours.
Your Endpoint Must Recognise Repeats
Assume a delivery can arrive more than once. Any event system that promises exactly-once to an arbitrary HTTP endpoint is overselling.
Retries Are Finite
A persistently failing endpoint is marked dead after five tries. For a complete record, read the event stream from where you left off.
Public HTTPS Only
Private, local and cloud-metadata addresses are refused, and redirects are not followed.
Read next
Count the API keys you have issued
Then count how many you could explain the purpose of. The gap is the reason this page exists.