Switch on request signing so your systems can confirm a webhook genuinely came from Pipeline CRM and wasn't altered on the way.
Before you start:
- Only admins can create or configure automations.
- You need an automation with a Call an API action already set up.
How Signing Works
Pipeline CRM follows the Standard Webhooks open specification, so ready-made verification libraries work in most languages — you don't have to write your own cryptography.
Each signed delivery carries three headers: a webhook id, a timestamp, and a signature. The signature is an HMAC computed with SHA256 over the delivery id, the timestamp, and the raw request body, then base64 encoded. Your receiver recomputes it with your shared secret and confirms the two match.
Exact header names are in the API documentation.
Turn On Signing for an Automation
- Log in as an admin and click Settings in the lower-left corner.
- Select Other, then click Automations.
- Open the automation you want to sign.
- Add a trigger in the "When..." section.
- In the "...do this" add the Call an API action and open the Request signing section.
- Create a signing secret.
- Copy the secret and store it somewhere safe.
Your signing secret is shown in full only once. Afterwards it's masked to its last four characters, so store it when you create it.
Signing is optional and set per automation. Any automation where you don't enable it keeps delivering exactly as it does today.
Test Before You Rely On It
Click Test on the automation to send a fully signed test delivery. Use it to confirm your verifier accepts real traffic before you go live.
Reject Replayed Deliveries
The timestamp is part of what gets signed. Your receiver should reject any delivery whose timestamp falls outside a short window — roughly 5 minutes — so an intercepted delivery can't be replayed later.
Rotate a Secret Without Downtime
When you rotate, a new secret is issued and the previous one keeps working for 7 days. Both signatures are sent during the overlap, so you can switch over cleanly without missing a delivery.
You can keep up to 2 active secrets per automation.
Two Things to Know
Secrets are managed in the app, not through the API. A webhook created through the API still needs signing switched on by a person in Automations.
A secret belongs to the whole automation, not to a single action. If one automation has more than one Call an API action, those actions share the same secret.
If you remove every signing secret from an automation, its deliveries continue without signature headers rather than stopping. Your receiver will start seeing unsigned traffic instead of an error.
Do You Need It?
Signing is optional. If your automations act on sensitive data or trigger important workflows, we strongly recommend turning it on. For a general picture of how automations are built, see Automations Overview.
Need help? Contact support at customercare@pipelinecrm.com.