Webhooks are signed per endpoint with a version 2 signature. The shared signing key is retired on 2026-09-28, and endpoints that have not proven ownership stop receiving on 2026-10-05.
What changed
Webhooks are now signed per endpoint with a version 2 signature over the delivery timestamp and body, sent in the x-trooth-signature-v2 and x-trooth-delivery-timestamp headers. Deliveries are tried three times with a five-second timeout and do not follow redirects. The shared signing key is retired on 2026-09-28; deliveries signed with it continue for seven days after that so receivers can move. From 2026-10-05, a webhook endpoint that has not answered the ownership challenge receives nothing.
Why it changed
One shared key signed every endpoint's deliveries, and deliveries went to endpoints whose owners had never proven control of them.
Who is affected
- Affected: Anyone receiving Trooth webhooks in a company workspace. Readers of public profiles are not affected.
- Availability: Company workspaces with webhook endpoints.
- Release stage: Available.
- Areas: Webhooks, Company workspace.
What to do
Action required by October 5, 2026. Verify x-trooth-signature-v2 with your endpoint's own secret, and answer the ownership challenge, before 2026-10-05. After that date an unproven endpoint receives nothing and no delivery carries the shared-key signature.
- September 28, 2026: Shared webhook signing key retired.
- October 5, 2026: Unproven webhook endpoints stop receiving; shared-key deliveries end.
Security details
- Affected: Receivers verifying the version 1 signature made with the shared signing key, and endpoints that never answered the ownership challenge.
- Fixed in: A version 2 signature per endpoint, x-trooth-signature-v2, over x-trooth-delivery-timestamp, a full stop and the raw body.
- Required action: Verify x-trooth-signature-v2 with your endpoint's own secret, and answer the ownership challenge, before 2026-10-05. After that date an unproven endpoint receives nothing and no delivery carries the shared-key signature.
- Advisory: Webhook reference
Versions and migration
Before:
// Version 1: one shared key for every endpointconst ok = hmac(SHARED_KEY, rawBody) === headers["x-trooth-signature"];After:
// Version 2: your endpoint's own secret, over the timestamp and the bodyconst ts = headers["x-trooth-delivery-timestamp"];const expected = "v2=" + hmac(ENDPOINT_SECRET, `${ts}.${rawBody}`);const ok = expected === headers["x-trooth-signature-v2"];Dates
- Announced: September 26, 2026, the day this entry was written. Entries are never backdated.
- Released: September 26, 2026.
- Shared key retired: September 28, 2026.
- Unproven endpoints stop: October 5, 2026.
What this does not fix
This release does not email the owners of endpoints still on the shared key. That notice is a separate step and has not been sent as of this entry.